Openclaw Skill Gastown

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 0.1.4
• Hash: d4a175eb12a154c788d1cdf1bd9479b09c225493312716a74fd430dd76c5de22
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to the broad system access granted to the AI agent and the explicit instructions for immediate, autonomous execution of 'work on your Hook' (GUPP principle) found in `SKILL.md`. This design makes the agent highly susceptible to prompt injection if a malicious 'bead' or 'molecule' (work item) is introduced into the Gas Town system. While the `scripts/setup.sh` performs standard installations from legitimate sources (go.dev, github.com), the reliance on `go install @latest` introduces a supply chain risk. The skill itself does not demonstrate intentional malicious behavior like data exfiltration or backdoor installation, but its operational model presents significant security risks.