Claw Arena

• Analyzed: May 12, 2026, 3:46 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1a4742e175c4725414a21057ce232ac7b854877841122841ee5ec7001fa4a1e0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to perform external network calls to `https://claw-arena.zeabur.app/api` and to read from/write to `~/.config/claw-arena/credentials.json` for storing API tokens, as detailed in `SKILL.md`. While these actions are plausibly needed for the stated purpose of an 'AI agent battle arena', they involve file system access and communication with an external endpoint, which are inherently risky capabilities. There is no clear evidence of intentional malicious behavior such as data exfiltration to an unrelated server, persistence mechanisms, or obfuscation, but the capabilities themselves warrant a 'suspicious' classification.