companion-skill

No direct malware behavior can be confirmed from this fragment because it is documentation/config guidance rather than the actual skill source code. However, the provided OpenClaw configuration example includes a plaintext API key, creating a serious credential exposure risk and enabling unauthorized or fraudulent use if the key is valid. Integration instructions also encourage loading built artifacts into the host runtime via copy/symlink, and npm install/build/test execute lifecycle code, but those risks depend on unseen package.json/dist contents. Treat the embedded key as compromised (rotate/revoke) and move secrets to a secure, non-committed mechanism (e.g., local .env/secret manager) before using the skill.

No direct evidence of malware is observable in the provided fragment because it contains mostly documentation and configuration examples, not the executable TypeScript/library code. However, the fragment contains a plaintext API key embedded in an OpenClaw configuration snippet, which creates a high likelihood of credential compromise and unauthorized API usage. Additional verification is required from the actual src/*.ts files and package.json (including scripts and dependencies) to rule out malicious behaviors beyond this configuration issue.

No direct evidence of malware/backdoors is present in the provided artifact because it is documentation rather than the package’s executable source. The key supply-chain security concern is a plaintext-looking API key embedded in the setup instructions, which represents a credential-leakage/billing-abuse risk if that key is real. The guide also describes multiple authenticated calls to an external image-generation API during automated generation, which is expected functionality but can increase operational impact if triggered unintentionally. Review the actual npm package source and CI/postinstall/test scripts for confirmation of network/file behaviors and for any secret handling issues.