Clawfy

• Verdict: Pass
• Analyzed: May 12, 2026, 4:09 AM
• Findings: 0
• Version: 0.1.1
• Hash: 3b0ae771f53ba13defad77b4652b322eac5b07ec20f9cf68d66e259983727ad3
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: clawfy Version: 0.1.1 The skill bundle is benign. The `SKILL.md` clearly defines the agent's role as a context-aware assistant, limiting its actions to reading webhook context, searching ClawHub for skills using the `clawhub search` CLI, and presenting `clawhub install` commands as copyable text to the user. Crucially, it explicitly states: 'Do not execute install commands or create skills. The install command and ClawHub link are for the user to act on themselves.' There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection designed to subvert the agent's intended behavior or security boundaries.