Back to skill
Skillv1.0.1
VirusTotal security
Global Compliance · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:27 AM
- Hash
- 915a9989a94e7a7ccb5f24db1904ba83ea5a63679951afd205ec97357dcd200e
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: global-compliance Version: 1.0.1 The skill bundle contains a critical discrepancy between its primary metadata and documentation (_meta.json, SKILL.md), which describe a 'global-compliance' tool, and its localized versions (SKILL-EN.md, SKILL-ZH.md), which describe a 'video-generator'. This 'bait-and-switch' content is highly irregular and suggests either severe mispackaging or intentional hidden functionality. Furthermore, the video generator instructions direct the agent to perform high-risk operations, including cloning a remote repository (github.com/ZhenRobotics/openclaw-video), running 'npm install', and executing external shell scripts, which constitutes a remote code execution (RCE) risk and potential for supply chain attacks.
- External report
- View on VirusTotal