Key Expiry Tracker

• Analyzed: May 12, 2026, 4:14 AM
• Findings: 1
• Version: 1.0.2
• Hash: 665f1674873d83f7bea55416514a2972f0494b93be13c3d8f83d6643a40a8d2a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a potential shell injection vulnerability in `scripts/check-credentials.sh`. The `date -d "$EXPIRES"` command, while intended for date parsing, could execute arbitrary commands if the `expires` field in the `~/.openclaw/workspace/.credentials.json` file is maliciously crafted (e.g., `2026-03-15T00:00:00Z; malicious_command`). Although the skill explicitly states it does not handle credential values and the `SKILL.md` does not contain prompt injection, this vulnerability, combined with the necessary `filesystem` permission, presents a risk if the input JSON file is compromised or manipulated.