Session Password

• Analyzed: May 11, 2026, 6:53 AM
• Findings: 1
• Version: 1.6.1
• Hash: 63c7da18dbf5e3abc3d0f3fbf7eaaf9b3111445bae3930bab217be642726a5ad
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a legitimate session authentication system for OpenClaw using industry-standard bcrypt hashing, security questions, and email-based recovery. The code is well-structured, follows security best practices such as restricted file permissions (0o600), and includes a transparent billing integration with the SkillPay platform ($0.01/call) as disclosed in SKILL.md and package.json. While it contains a hardcoded API key in scripts/billing.js, this appears to be a design choice for the skill's monetization model rather than a malicious backdoor or exfiltration mechanism.