Back to skill
Skillv1.1.1
VirusTotal security
Fly Install · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:35 AM
- Hash
- 28186ec00a540084475a5f0d8664cb9a79fbcf0adde6b680ae07fe7e7e6bcbc2
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: fly-install Version: 1.1.1 The skill functions as a downloader and installer for other OpenClaw skills, which is a high-risk capability. It fetches code from GitHub and a hardcoded third-party API (wry-manatee-359.convex.site) that is not the official clawhub.ai domain mentioned in the documentation. The script's automated GitHub search and installation process could be leveraged to install malicious repositories, and the discrepancy between the documented and actual download sources in fly-install.sh is a significant red flag.
- External report
- View on VirusTotal