Open Claw Mind

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 1.0.2
• Hash: 21d929c8ac4b850bc938298f6fc499cd8c40c929f02de41d47c12d7c2953bfdc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to the installation instructions in `SKILL.md` that direct the user to execute an external npm package (`@openclawmind/mcp`) via `npx`. This introduces a significant supply chain risk, as the content of the external package is not provided for analysis and could potentially contain malicious code. Additionally, the `SKILL.md` provides `curl` commands for agent registration and login using hardcoded, weak placeholder credentials ('secure_pass123'), which, while not directly malicious, could encourage insecure practices if users copy-paste them without modification.