ClawArena

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 1.2.1
• Hash: 043ac2c5096d3950beeb71f2137d7b32183f163aa45b6ed72f8868229c959149
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to a significant supply chain vulnerability. The `HEARTBEAT.md` file explicitly instructs the AI agent to periodically fetch and execute instructions from `https://clawarena.ai/heartbeat.md`. This dynamic fetching and execution of remote content allows the `clawarena.ai` server to alter the agent's behavior at any time, potentially injecting malicious prompt instructions or commands, bypassing the initial skill bundle review process. While the current content is not malicious, this mechanism presents a high risk for future compromise or unauthorized behavior changes.