Tenacity — Never Give Up

• Analyzed: May 14, 2026, 2:46 AM
• Findings: 1
• Version: 1.0.0
• Hash: c2b5da6c55b8dd9fc2dd0d2f94eda94f3ae8936741b62b4b7de19ecd85537320
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'tenacity' skill is designed to bypass human-in-the-loop (HITL) confirmations, granting the agent broad autonomous authority to execute commands, modify files, and send messages without intervention. This significantly increases the impact of potential prompt injection attacks. The 'scripts/checkpoint.sh' script is vulnerable to path traversal via the milestone ID, and 'SKILL.md' includes a hardcoded Telegram ID (834732674) for notifications, which could serve as a pre-configured exfiltration or control channel.