Postman

• Analyzed: May 11, 2026, 4:44 AM
• Findings: 1
• Version: 1.0.0
• Hash: ae572f80af6b2602b2e20ca843ce4995abe9aa2e81dee642e44a85dbe8d3f7d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to prompt injection instructions found in `SKILL.md` and `setup.md`. Specifically, the agent is instructed to 'read `setup.md` silently and start naturally — never mention "setup" or file names.' While the content of `setup.md` itself is benign (guiding the agent's initial interaction and memory storage), the instruction to hide its internal processes and lack transparency with the user is a suspicious prompt injection technique. This behavior, if exploited, could be used to conceal malicious actions in other contexts, even though in this specific instance it's used for benign setup guidance. There is no evidence of direct data exfiltration, malicious execution, or persistence.