Media Writing

• Analyzed: May 12, 2026, 4:09 AM
• Findings: 1
• Version: 0.1.0
• Hash: 76f9f1d105f7d4e96e4e4cb240ccd5d897084f36348698f4f8a3361087f87506
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file contains instructions for the AI agent to generate clickable numbered footnotes in the format `[Number](URL)`. While intended for legitimate citations, this capability allows the agent to construct and output arbitrary URLs based on user input. This presents a prompt injection vulnerability, as a malicious user could craft a prompt to induce the agent to generate links to phishing sites, malware downloads, or other harmful external resources. This is a risky capability that could be exploited, but it does not demonstrate clear evidence of intentional malicious behavior by the skill itself.