Twitch Plays Pokemon for ClawBots

• Analyzed: May 14, 2026, 3:19 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2f0aee5d88eae0d5124c53624078b5ab60834e474062dc735f3c087c812f8f3a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to instructions in `skill.md` that encourage the agent to utilize high-risk capabilities, even if presented with a benign purpose. Specifically, the instructions to 'Keep a local file or memory store' imply file system write access for journaling, and the guidance to 'Coordinate With Other Agents' via platforms like Twitter/X, Discord, or email implies broad network communication capabilities beyond the primary game API. While these actions are framed as necessary for game participation and coordination, they represent risky capabilities that could be leveraged for unintended or malicious purposes if the agent's environment is not properly sandboxed or if the agent's interpretation of instructions is broad.