Mixtiles Monthly

• Analyzed: May 12, 2026, 4:15 AM
• Findings: 1
• Version: 1.0.0
• Hash: 52024a45511b97dcf31f245ed8d234beb04a4443601d9bbea0a5f4555c783b0f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's stated purpose is benign, and the `SKILL.md` does not contain prompt injection attempts to subvert the agent. However, the `scripts/collect-photos.sh` script directly uses shell variables (e.g., `$GROUP_JID`, `$AFTER_DATE`, `$OUTPUT_DIR`) as arguments to external commands like `wacli` and `mkdir`. While the skill itself sets `OUTPUT_DIR` to a controlled path, this pattern introduces a shell injection vulnerability risk if these inputs could be controlled by a malicious actor and the `wacli` tool or the OpenClaw agent's argument handling does not properly sanitize or escape them. This is a vulnerability, not evidence of intentional malicious behavior.