Customer Onboarding

• Analyzed: May 12, 2026, 3:57 AM
• Findings: 1
• Version: 1.1.0
• Hash: ed3e668cbc1772358f87f7a0619b46942f93792c2a0189b47e8118f1ef9628c0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file contains `clawhub install` commands, which are command-like strings. If an AI agent is vulnerable to prompt injection, it could interpret these as instructions to execute, leading to Remote Code Execution (RCE). Additionally, `SKILL.md` and `README.md` contain external URLs (e.g., `https://afrexai-cto.github.io/context-packs/`). If the agent has web browsing capabilities and is susceptible to prompt injection, it could be instructed to access these URLs, leading to unauthorized network access. While these elements are likely intended for user interaction or marketing, they represent significant prompt injection vulnerabilities, classifying the skill as suspicious due to risky capabilities without clear malicious intent.