Back to skill
Skillv1.0.0
VirusTotal security
Drink Water Reminder · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
ReviewMay 1, 2026, 5:09 AM
- Hash
- fb76c782801f32ff828075503d080ada128cf6a4c059d1570d9fe12399c101a6
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: drink-water-reminder-yikailucas Version: 1.0.0 The skill's stated purpose is benign, creating hydration reminders. However, the `scripts/add_reminder.sh` script directly uses user-provided arguments (`$1` for interval, `$2` for message) without sanitization when constructing the `openclaw cron add` command. This introduces a potential shell injection vulnerability, as malicious input in the interval or message parameters could lead to arbitrary command execution if the `openclaw` CLI does not robustly sanitize or escape its arguments.
- External report
- View on VirusTotal