Back to skill
Skillv1.1.2
VirusTotal security
GigaChat (Sber AI) Proxy · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 29, 2026, 5:16 AM
- Hash
- a8dd0aa4cd66209f0f5fbc37c5dba50829727e8e31b9bee193084a7ec7ea20d9
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: sber-gigachat Version: 1.1.2 The skill bundle contains functional scripts for GigaChat integration but includes high-risk security practices and vulnerabilities. Specifically, `scripts/start-proxy.sh` and `scripts/start.sh` explicitly disable SSL certificate verification by default if the Sber CA is not found, which exposes the connection to Man-in-the-Middle (MITM) attacks. Additionally, `scripts/patch-config.sh` is vulnerable to Python code injection because it unsafely interpolates the `$CONFIG` environment variable directly into a `python3 -c` command string. While these appear to be functional workarounds or unintentional flaws, they constitute significant security risks.
- External report
- View on VirusTotal