Base Alpha Scanner

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: 36278a575365a67d639edb1acccb0b238fb1d6dd4b124cfd1f36170e84e6f8dc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to potential URL injection vulnerabilities in `scripts/scan_base.py` and `scripts/scan_narrative.py`, where user-controlled `addr` arguments are directly inserted into API URLs via f-strings without explicit URL encoding. Additionally, `SKILL.md` explicitly instructs the AI agent to utilize `browser`, `web_search`, and `web_fetch` tools for data retrieval, which, while intended for legitimate scraping, broadens the attack surface for prompt injection if the agent's input is not rigorously sanitized. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints or backdoor installation.