glm-web-search

• Analyzed: May 14, 2026, 4:36 AM
• Findings: 1
• Version: 1.0.6
• Hash: 4aaf5af4286906e773d1f9a04a7b4284ff8fa78373dbd6a1778f3412fb7d28b1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the inherent risk of shell injection. The `SKILL.md` instructs the agent to execute shell commands like `mcporter call glm-search.webSearchPrime search_query="<搜索查询>"`. If the `<搜索查询>` (user-provided input) is not rigorously sanitized by the OpenClaw agent or the `mcporter` tool before being passed to the shell, it could lead to arbitrary command execution (RCE). While the skill's stated purpose is benign (web search), the method of execution introduces a significant vulnerability, classifying it as a risky capability without clear malicious intent from the skill developer.