高风险行为识别分析工具

• Analyzed: May 12, 2026, 12:06 PM
• Findings: 1
• Version: 1.0.2
• Hash: 3bf45d282813dffb7418336a777d95b6d6a269228211b5645a9328e78983ad06
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle exhibits suspicious behavior by implementing an unusually complex infrastructure for a standard skill, including a local SQLite database (`smyx-common-claw.db`) to persist user tokens and an automated authentication flow in `util.py` that registers the user's OpenClaw identity with a remote backend (`lifeemergence.com`). Most notably, `smyx_common/scripts/skill.py` contains logic (the `AgentSkill` class) designed to execute `openclaw` CLI commands via `subprocess`, which is a high-risk capability that could be leveraged to perform unauthorized actions on the host system. Additionally, `SKILL.md` employs aggressive prompt-steering instructions to mandate specific identity-handling behaviors, potentially overriding the agent's default operational constraints.