Claw Fm

• Analyzed: May 12, 2026, 3:38 AM
• Findings: 1
• Version: 1.0.1
• Hash: c950e5cfb4cc7163d32a82ee7b73c9d2cd48a3f7ed60c6b363064268623eb218
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its requirement and explicit instructions for handling a cryptocurrency private key (`CLAW_FM_PRIVATE_KEY`) for x402 payments, as detailed in SKILL.md. While this capability is central to the skill's stated purpose of submitting music to claw.fm, the direct handling of such a sensitive credential represents a significant inherent security risk. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints, prompt injection attempts to subvert the agent, or other clear harmful actions beyond the stated purpose.