C.R.A.B Deploy Agent

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.1.0
• Hash: 692b91220191f25863b5a5b39f4e8fb8893b78e78dd3c855e1d73a7a0e5081c5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a multi-step deployment workflow for full-stack applications. The `SKILL.md` clearly outlines the purpose, required binaries (`gh`, `wrangler`, `git`, `jq`), and configuration. The `deploy-agent.sh` script acts primarily as a state manager and workflow orchestrator. Crucially, the script does not directly execute high-risk commands like `gh repo create` or `wrangler pages deploy`. Instead, it prints `info` messages indicating what commands *would* be run, implying that the OpenClaw AI agent is expected to interpret these messages and perform the actual execution. There is no evidence of intentional harmful behavior, data exfiltration, persistence, or prompt injection attempts against the agent. The behavior is aligned with its stated purpose of managing a deployment workflow.