Openclaw Deploy

• Analyzed: May 12, 2026, 3:21 AM
• Findings: 1
• Version: 1.0.4
• Hash: 3b8c79a82b8a648d30054d19ffde9cb6ef174b38c65ea02883481de1c5fcb1b1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `curl -o- ... | bash` in `templates/install-node.sh` for NVM installation, which is a risky pattern for executing remote code and represents a supply chain vulnerability. Additionally, hardcoded paths like `/home/zfanmy/openclaw_data/workspace` in `scripts/start.sh` and specific NVM paths in `scripts/build-portable.sh` and `templates/start-*.sh` introduce vulnerabilities related to environment assumptions and potential permission issues. While the skill's primary purpose is deployment and backup, these practices introduce significant security risks without clear malicious intent.