ClawHub发布助手

• Analyzed: May 9, 2026, 3:26 PM
• Findings: 1
• Version: 1.0.3
• Hash: 650f42bb1e5e7daa94607de19cf1c48e091f3bdca2017f6e1b4f737fe7d67c7b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates the publication of OpenClaw skills to the ClawHub platform using shell commands (Node.js, PowerShell, Bash), file system modifications, and the `clawhub` CLI. It includes instructions in `SKILL.md` for the agent to execute an optional `publish.sh` script found in target directories and to handle authentication tokens via the command line. While these capabilities are aligned with the tool's stated purpose, the use of arbitrary script execution and broad shell access constitutes a high-risk profile according to the provided criteria, despite lacking evidence of intentional malice.