SP-API Skill

• Analyzed: May 11, 2026, 4:56 AM
• Findings: 1
• Version: 1.0.1
• Hash: 9c5d6d2a87259f27223fb8927ed58ebd0786e8ffee878a603718b76cdf26b195
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a potential arbitrary file write vulnerability. The scripts `scripts/inventory.js`, `scripts/listings.js`, and `scripts/orders.js` directly use the `--out` command-line argument as a file path for `fs.writeFileSync` without any sanitization or validation. This could allow an attacker, via prompt injection against the OpenClaw agent, to instruct the agent to write arbitrary data to arbitrary file paths on the system, potentially leading to remote code execution or data corruption.