Back to skill
Skillv1.1.0
VirusTotal security
Skill Auto Publisher · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
BenignApr 30, 2026, 6:24 AM
- Hash
- ebffe82557a8d33952fbec6e2439da678d08c9ad63cbc3d993ec9c8d8b01cdaa
- Source
- palm
- Verdict
- benign
- Code Insight
- Type: OpenClaw Skill Name: skill-auto-publisher Version: 1.1.0 The skill bundle is a developer utility designed to automate the publication of OpenClaw skills to ClawHub. It includes scripts for metadata validation (validate_meta.py), name collision checking (check_slug.py), and version/history tracking (publish_history.py). While publish.sh contains minor shell-to-python injection vulnerabilities due to unquoted variable interpolation in 'python3 -c' commands, there is no evidence of intentional malice, data exfiltration, or unauthorized remote execution. The behavior is consistent with the stated purpose and includes mandatory user confirmation steps before execution.
- External report
- View on VirusTotal