Estimate Builder

• Analyzed: May 12, 2026, 4:32 AM
• Findings: 1
• Version: 1.0.1
• Hash: 0843474816bd5cac3c5ea718599159a036960581906cd720f18d95ef4275fb77
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a potential arbitrary file write vulnerability. The `export_to_excel` function in `SKILL.md` takes an `output_path` argument and writes an Excel file to it. Combined with the explicit `filesystem` permission requested in `claw.json`, this allows the skill to write files to arbitrary locations on the system if the `output_path` is not properly sanitized or restricted by the OpenClaw agent, posing a risk of overwriting critical files or achieving persistence. While this is a significant vulnerability, there is no clear evidence of intentional malicious behavior such as data exfiltration or backdoor installation.