Openclaw Greek Accounting Meta

• Analyzed: May 12, 2026, 4:30 AM
• Findings: 1
• Version: 0.1.0
• Hash: 71fa80fb2ce41bab4ee42f731f911393879b39a8d66296b6ca8cf953faee590b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw Greek Accounting Meta-Skill demonstrates legitimate orchestration functionality for an accounting system, including positive security features like mandatory human confirmation for government submissions and role-based access checks. However, the Python code snippet in `SKILL.md` reveals a shell injection vulnerability in the `call_skill` method. This method constructs shell commands using f-strings that directly embed variables (e.g., `afm`, `user`) without sanitization. If an AI agent processes untrusted user input for these variables, it could lead to arbitrary command execution on the host system, classifying it as suspicious due to this critical vulnerability.