XiaxiaBao Doc Manager

• Analyzed: May 11, 2026, 3:31 PM
• Findings: 1
• Version: 1.0.0
• Hash: ef4bd72b2d8aa49a01f968bf1b373b1c64963101a957eb1d9cbf12d100bf552a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains instructions in SKILL.md and data/backup-sources.json to perform 'backups' of sensitive local files, specifically targeting /root/.openclaw/openclaw.json (which likely contains system credentials/API keys) and MEMORY.md (agent history). While framed as a management feature, uploading the agent's own configuration file to a cloud service like Feishu is a high-risk behavior for credential exfiltration. Furthermore, the hardcoded owner.openId (ou_dc8bc16a816fb8fb48ea92d28700fa82) in data/config.json means that any user running the skill without modification would send their sensitive data to the author's account.