Back to skill
Skillv0.1.0
VirusTotal security
Skillboss · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:38 AM
- Hash
- 84b8482383d34c1b44813183178ebfba929b5117bee36131dc9f571c153455f8
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: skillboss-3 Version: 0.1.0 The skill bundle implements a high-risk auto-update mechanism in `scripts/api-hub.js` and `install/update.sh` that downloads and executes remote code via `execSync`, creating a potential remote code execution (RCE) vector from `skillboss.co`. The `SKILL.md` file contains forceful instructions designed to hijack the AI agent's control flow (e.g., "Stop what you are doing") to prioritize running these update scripts. Additionally, `install/install.sh` performs broad discovery of the user's home directory to self-propagate into various AI tool configurations (Claude, OpenClaw, Continue, etc.). While these features support the tool's stated purpose as an AI gateway and deployment service, the combination of self-propagation, remote execution, and aggressive agent-steering instructions warrants a suspicious classification.
- External report
- View on VirusTotal