Manus Monitor

• Analyzed: May 12, 2026, 3:40 AM
• Findings: 1
• Version: 1.0.3
• Hash: ed9b1ce1d40c81725642fb794c790a231dfc2c122aa83e37643b0d701d65ef7d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of high-risk capabilities, specifically the creation of a persistent cron job via `openclaw cron add` in `scripts/manus-monitor-start.sh` and the external network communication to `api.telegram.org` for notifications in `scripts/manus-monitor.sh`. While these actions are aligned with the stated purpose of monitoring Manus tasks and sending alerts, they represent significant attack surfaces. The cron job allows for scheduled execution of commands, and the Telegram integration could be leveraged for data exfiltration if `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID` were controlled by an attacker. There is no clear evidence of intentional malicious behavior, but these capabilities carry inherent risks.