Clawhub Smart Updater

• Analyzed: May 7, 2026, 12:31 PM
• Findings: 1
• Version: 1.1.1
• Hash: b984e5af0f8fa2c1ba5e9a4eafa3fb66eb884f97191d0d541b4ac670c9ebf9f0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a utility for managing and updating other OpenClaw skills with conflict detection and backup capabilities. It is classified as suspicious due to several discrepancies and high-risk patterns: it utilizes 'subprocess.run(shell=True)' in 'smart-update.py' which poses a shell injection risk, and its documentation ('SKILL.md', 'README.md') claims security features like VirusTotal integration that are entirely absent from the provided source code. Furthermore, the inclusion of 'VETTING_REPORT.md' appears to be a social engineering attempt to preemptively influence security analysts and bypass automated scanners by dismissing potential flags as false positives. While no explicit evidence of data exfiltration or backdoors was found, the combination of risky execution patterns and deceptive documentation warrants a suspicious classification.