ChatClaw — Dashboard

• Analyzed: May 18, 2026, 8:45 AM
• Findings: 1
• Version: 0.5.0
• Hash: 0fb9b670864fe3b61086c768e61f8efc7a5101a8285250f61564dd26b4741830
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill functions as a remote management bridge that grants a third-party cloud relay (api.sumeralabs.com) extensive control over the local OpenClaw agent. It provides capabilities for remote file exfiltration from the workspace, cron job manipulation, and the ability to install or toggle other skills via subprocess execution of 'openclaw' and 'clawhub' commands in main.py. While these features are transparently documented as part of a cloud dashboard service, the requirement for high-privilege 'operator.admin' scopes and the potential for the remote endpoint to be used as a command-and-control (C2) vector represent a significant security risk.