trade-with-aiusd

• Analyzed: May 12, 2026, 3:27 AM
• Findings: 1
• Version: 1.0.2
• Hash: 0c55650f20f2c23da9bcaad8cfa98b11f7b9e2bea8c602a06fcc3e9065657690
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to the inherent risks associated with a cryptocurrency trading agent, particularly the execution of `npm install` which is a known supply chain attack vector, and the extensive agent-control instructions in `SKILL.md`. While these instructions appear to be defensive (e.g., preventing the agent from leaking login URLs like `https://mcp.alpha.dev/oauth/login`), they represent a form of prompt manipulation that could be risky in an unsandboxed AI environment. There is no clear evidence of intentional malicious behavior such as unauthorized data exfiltration or persistence mechanisms beyond the skill's stated purpose of managing AIUSD accounts and trades.