Date Night

• Analyzed: May 12, 2026, 4:16 AM
• Findings: 0
• Version: 1.4.0
• Hash: 23debe0da77dd57867192a617a5869d09cfecb37dffbd96259d2d15e446ba6ca
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: date-night Version: 1.4.0 The skill bundle exhibits multiple critical shell injection vulnerabilities (RCE risk) and significant prompt injection risks. Specifically, the `SKILL.md` file's onboarding flow, `references/smart-features.md`'s history update via `python3 -c`, and `references/sms-codes.md`'s config update all construct shell commands by directly interpolating user-controlled variables, creating a direct path for arbitrary command execution if input is not sanitized. Additionally, agent instructions in `SKILL.md` and `references/smart-features.md` are templated with user input, posing a prompt injection risk. While there is no clear evidence of intentional malicious behavior (e.g., exfiltration to an attacker-controlled server), these severe vulnerabilities make the skill highly exploitable.