Back to skill
Skillv0.1.0
VirusTotal security
Promql Validator · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
ReviewApr 30, 2026, 6:10 AM
- Hash
- 7ef8a1bf1bed7abd7a86a8375ac4f07cf5d6addebc598025cf16af4c4920cde8
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: promql-validator Version: 0.1.0 The skill provides PromQL validation and linting using local Python scripts. It is classified as suspicious because the instructions in SKILL.md direct the AI agent to execute shell commands using unsanitized user input (the "<query>" parameter), which constitutes a shell injection vulnerability. While the underlying Python scripts (validate_syntax.py and check_best_practices.py) are well-documented, include a test suite (test_validators.py), and perform only safe regex-based analysis without dangerous imports or network access, the instruction pattern itself creates a high-risk surface for prompt injection attacks against the agent.
- External report
- View on VirusTotal