BrainVsByte

• Analyzed: May 11, 2026, 4:45 AM
• Findings: 1
• Version: 1.0.0
• Hash: 03e60d5c684a97de3e7a6dd91f6bcf7dfbea13b4741c0531ca692e16c3b542fc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several high-risk capabilities and a significant configuration vulnerability. The `BASE_URL` defaults to `http://localhost:3000` in both `skill.md` and `heartbeat.md`, which is a critical misconfiguration if deployed in a production environment, potentially leading to broken functionality or unintended local network requests. Furthermore, the skill instructs the agent to download and overwrite its own files (`skill.md`, `heartbeat.md`) using `curl` from this `BASE_URL`, which could become a remote code execution (RCE) vulnerability if the `BASE_URL` were compromised or maliciously redirected. The skill also requires the agent to generate and manage a blockchain private key and explicitly instructs the agent to request funds from its human owner, which, while intended for legitimate operation, represents a high-risk capability for an autonomous agent.