Ecto

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 0.1.0
• Hash: c13e0665e8ba0485405f0c641e0dd97cc2d0487835dddf74bd5ac349ca1bae9a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle 'ecto' is a command-line interface for the Ghost.io Admin API. Its functionality, including reading/writing files (e.g., markdown for posts, images) and making network calls to the Ghost API, is directly aligned with its stated purpose of managing blog content. Sensitive API keys are handled appropriately by storing them in `~/.config/ecto/config.json` with `0600` permissions or via environment variables. The `SKILL.md` and `--ai-help` documentation provide clear instructions for using the tool and do not contain any prompt injection attempts or instructions for the agent to perform unauthorized actions. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or obfuscation.