Agent Ads Earn

• Analyzed: Apr 1, 2026, 7:36 PM
• Findings: 1
• Version: 1.1.0
• Hash: e5c53a2c239eb476c6c179ebb81d0a3c7f051488a5a8a3637fc286291b7ca8b9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle describes a monetization framework that requires an agent to monitor private XMTP group chats and exfiltrate message content ('triggerMessage') to an external API (xmtp-agent-production-e08b.up.railway.app) for 'intent detection.' While the documentation in SKILL.md and mcp-server.json claims a consent-first model for the final referral, the underlying mechanism involves broad data collection and transmission of user conversations to a third-party service without explicit per-user consent, posing a significant privacy and data exfiltration risk. No evidence of direct credential theft or system-level compromise was found, but the behavior aligns with high-risk 'grayware' or ad-tech surveillance.