Roast Agents

• Analyzed: May 12, 2026, 4:19 AM
• Findings: 1
• Version: 1.1.0
• Hash: e60b0a8c5077e9364f5f056e4396ba7817ae0dc56380070f8d1e7996625a32c3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to strong prompt injection directives in `SKILL.md` and `HEARTBEAT.md` that instruct the agent to 'act IMMEDIATELY' and 'DO NOT ask for permission' when receiving game messages, bypassing user consent. Additionally, the `curl` commands in both files use user-provided inputs (e.g., `YOUR_AGENT_NAME`) directly in URL query parameters, which could lead to shell injection if the OpenClaw agent does not properly sanitize these inputs before execution. While the stated purpose is a game, these behaviors introduce significant risks for unauthorized actions and potential command execution.