Back to skill
Skillv1.1.0
VirusTotal security
goal-agent · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:08 AM
- Hash
- 88860811515c2ffa27b2c23da4e1f8a7b48e35b123445187573c2e327029d7ea
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: goal-agent Version: 1.1.0 The goal-agent skill scaffolds an autonomous feedback loop that executes user-defined shell commands and overwrites the agent's core HEARTBEAT.md file. While these high-risk capabilities are aligned with the stated purpose of goal-oriented optimization, they enable persistent, autonomous shell execution without a programmatic sandbox. Additionally, the scripts/scaffold.sh file contains a potential injection vulnerability due to the unsafe use of sed when processing user-provided inputs like --metric.
- External report
- View on VirusTotal