Cx Agent Studio

• Verdict: Pass
• Analyzed: May 11, 2026, 4:57 AM
• Findings: 0
• Version: 1.0.0
• Hash: 8e352bdade0e3cd16b352bafbebcdf91c5df04021325677b5f0c16ce73e9a97e
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: cx-agent-studio Version: 1.0.0 The skill bundle, primarily documentation, describes a platform (CX Agent Studio) that allows for the execution of arbitrary Python code as 'tools' and 'callbacks' (`references/tools.md`, `references/callbacks.md`). These Python hooks can inspect and modify model requests/responses, tool arguments/results, and the agent's internal state (`context.state`), offering extensive control over the agent's behavior. While presented as legitimate development features, these capabilities represent a significant attack surface (e.g., potential for RCE, data manipulation, or exfiltration) if not properly secured or if malicious code is introduced by a developer or via prompt injection. The documentation itself does not contain malicious code or instructions for the OpenClaw agent to perform harmful actions, but it highlights inherently risky capabilities within the described platform.