Agent Tab Title

• Analyzed: May 14, 2026, 9:01 AM
• Findings: 1
• Version: 0.1.1
• Hash: 32dbef6e401f3337f538033dbe10ddfc520013e759d80dc8350ced4c93816689
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill performs live patching of the OpenClaw Control UI by modifying the 'index.html' file within the global npm or NVM installation directories. While the injected JavaScript in 'scripts/apply.sh' appears limited to updating 'document.title', the mechanism of modifying application source code is a high-risk behavior that could be leveraged for XSS or persistence. The script requires write access to package distribution files to function as described in 'SKILL.md'.