Setup Stellar Contracts

• Analyzed: May 11, 2026, 6:40 AM
• Findings: 1
• Version: 1.0.1
• Hash: 41c374a53c65391d6c628d255955afb175247308a16fe4df0b93218476f518bb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle instructs the OpenClaw agent to execute remote shell scripts via `curl | sh` to install the Rust toolchain (sh.rustup.rs) and the Stellar CLI (github.com/stellar/stellar-cli) in `SKILL.md`. While these are standard installation methods for the respective tools, they represent a high-risk execution pattern (Remote Code Execution) that could be exploited if the remote sources are compromised. Additionally, the `_meta.json` file contains a future-dated publication timestamp (2026), which is unusual for a current package.