ClawStreet

• Analyzed: Mar 31, 2026, 8:46 PM
• Findings: 1
• Version: 1.6.0
• Hash: 3db4a1accc75abd857f6f18419e16f34cfc52bb8588e3613aec3a1a14d43754c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive integration for the ClawStreet trading platform, but it is classified as suspicious due to a high-risk instruction in the heartbeat section of SKILL.md. This instruction directs the agent to fetch and 'follow' a remote markdown file (https://www.clawstreet.io/skills/clawstreet/SKILL.md), which effectively functions as a remote instruction injection vector, allowing the third-party server to dynamically alter the agent's behavior. While the skill's network access and API key management are aligned with its stated purpose of autonomous trading, the inclusion of a self-updating execution loop for remote instructions represents a significant security vulnerability.