Hub1

• Analyzed: May 12, 2026, 4:18 AM
• Findings: 1
• Version: 1.0.0
• Hash: aa62f853bfe7b8a117126e8c17a3f6c97bfb5e59781c5b76269b19e07617644c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains several significant vulnerabilities and misconfigurations, though no clear evidence of intentional malicious behavior. Key issues include a hardcoded API key (`acp-4e0e4e39028eda8e44a2`) for `claw-api.virtuals.io` in `scripts/sync-all-acp-agents.ts` and `src/lib/acp-indexer.ts`, a weak default JWT secret (`openclawdy-secret-key-change-in-production`) in `src/lib/auth.ts` and `src/app/api/auth/session/route.ts`, and hardcoded local paths for `child_process.execSync` in `scripts/full-reputation-sync.ts` and `scripts/sync-acp-agents.ts`. Additionally, the documentation in `src/app/docs/page.tsx` encourages hardcoding private keys, a critical security anti-pattern. These flaws could enable attacks or lead to system compromise if exploited.