claw-lark Patches

• Analyzed: May 12, 2026, 4:34 AM
• Findings: 1
• Version: 1.0.0
• Hash: 69cb12611207c9b2d161f4d5a3c1ef089f2346dcfeb8d9d0207e57b195eec96f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle's purpose is to apply specific, documented patches to the local 'claw-lark' plugin files to enhance its functionality (e.g., mention filtering, thread replies). The `scripts/apply-patches.sh` script uses a Node.js heredoc to perform string replacements on local JavaScript files within the OpenClaw extension directory. While modifying compiled files via string replacement can be fragile and lead to issues if the target files change, this is a technical vulnerability of the patching method, not evidence of malicious intent. The script operates entirely locally, does not exfiltrate data, install backdoors, execute arbitrary remote code, or contain prompt injection attempts designed for harmful objectives. The `SKILL.md` provides clear, benign instructions for the user/agent.