Back to skill
Skillv1.0.3
VirusTotal security
OpenClaw News Watcher · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
ReviewApr 30, 2026, 6:35 AM
- Hash
- a68c099bcd24af79e9deeda909fff605f0143e9877dded6109b1be56a636391a
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: news-watcher Version: 1.0.3 The skill monitors cryptocurrency news using Playwright and summarizes articles via an AI agent. It is classified as suspicious due to a significant vulnerability to indirect prompt injection in `scripts/watch-news.js`, where raw, untrusted web content is concatenated directly into an AI prompt. Additionally, the script utilizes `execFileSync` to execute a path defined by the `OPENCLAW_MJS` environment variable; while this is intended to call the OpenClaw core logic, it represents a risky execution pattern if the environment variable is manipulated.
- External report
- View on VirusTotal