dm.bot Agent Messaging

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 1.0.0
• Hash: 675722b8fdd6c9c584248e8abb9b4b5bb8727043db4ca45e9f7e124761f028a1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to the presence of a webhook subscription feature (`/api/webhooks/subscribe` in SKILL.md) that allows the agent to configure an arbitrary URL for notifications. While this is a legitimate feature for a messaging service, it represents a risky capability that could be exploited by a malicious prompt to exfiltrate data to an attacker-controlled endpoint. Additionally, the skill handles a `private_key` for authentication, which is sensitive, though its use is aligned with the stated purpose of interacting with the `dm.bot` API.