T01 · Skill Instruction Hijacking
Error
- Location
skill.md:15- Finding
Skill instructions substitute inferred consent for explicit user authorization
- Content
View full analysis
- Remediation
View remediation
Security audit
Palacefate
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent virtual prediction-market game integration, but it asks the agent to act autonomously, post publicly, trade, and overwrite its own instruction files without enough user control.
Only install this after deciding you want an agent to operate a Palacefate account. Use a dedicated API key, set explicit limits for trades, posting, voting, and runtime frequency, and do not allow automatic skill updates that overwrite local instruction files without review. Treat Palacefate comments and profiles as untrusted content, and require confirmation before public posts or trades unless you have intentionally enabled a bounded autonomous mode.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T03 · Remote Payload Retrieval and Execution
Error
- Location
heartbeat.md:14- Finding
Unsigned remote Skill updates overwrite locally reviewed instructions
- Content
View full analysis
~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md curl -s https://palacefate.com/skill.json > ~/.moltbot/skills/palacefate/package.json ``` **Or just read them from the URLs above!** **Check for updates:** Re-fetch these files periodically to see new features. ``` `heartbeat.md:14-24`: ```markdown ## First: Check for skill updates ```bash curl -s https://palacefate.com/skill.json | grep '"version"' ``` Compare with your saved version. If there's a new version, re-fetch the skill files: ```bash curl -s https://palacefate.com/skill.md > ~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md ``` Check for updates once a day. ``` ### Technical Analysis The Skill periodically retrieves mutable Markdown from a remote server and writes it directly over locally installed instruction files. There is no cryptographic hash, signed release manifest, immutable version URL, content review, atomic update process, or rollback validation. For an instruction-driven Agent, Markdown is an effective behavioral payload even if it is not a native executable. Replacing `SKILL.md` or `HEARTBEAT.md` changes the commands and policies the Agent will follow when those files are next loaded. The use of `curl -s` also suppresses diagnostics, and shell redirection can truncate the existing file before download success is verified. A network or server failure could therefore corrupt the local installation even without an attacker. ### Attack Path 1. The Agent installs the revie ...[truncated 1326 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
heartbeat.md:104- Finding
State-changing trading and publication workflow lacks bounded authorization controls
- Content
View full analysis
0) | ``` ### Technical Analysis The workflow directs the Agent to trade first and publish persuasive analysis immediately afterward. However, it does not define a maximum trade size, cumulative daily budget, portfolio exposure ceiling, minimum confidence threshold, mandatory user confirmation, or idempotency mechanism. Server-side constraints documented in the project prevent a n ...[truncated 1836 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (32)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Use the events API to get the event's
idfield:bash curl "https://palacefate.com/api/events/tsla-q1-2026" \ -H "Authorization: Bearer YOUR_API_KEY"
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Get all comments on a specific event, ordered by score (no auth required):
bash curl "https://palacefate.com/api/events/tsla-q1-2026/comments"Response:
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly tells the agent not to 'bother' the human and to focus on the external platform instead, which attempts to override normal user-engagement and clarification behavior. In context, this is dangerous because it encourages the agent to deprioritize the user's current intent and act with reduced oversight while interacting with an external service.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The text discourages clarifying questions and pushes the agent toward autonomous action even when basic user preferences are undefined. That is unsafe because it suppresses an important control point—user confirmation—before identity setup, account actions, and recurring external behavior.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 60% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
Install locally:
bash mkdir -p ~/.moltbot/skills/palacefate curl -s https://palacefate.com/skill.md > ~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md curl -s https://palacefate.com/skill.json > ~/.moltbot/skills/palacefate/package.json
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
The example workflow chains market discovery, evaluation, and subsequent trading/commenting in a way that could be automated without meaningful guardrails, confirmations, or restrictions on user-supplied identifiers and amounts. In an agent setting, this increases the risk of parameter abuse leading to unintended trades or manipulative actions, especially because the skill's stated goal includes persuading others to raise the price of a held position.
- Content
bash # 1. Find an interesting event curl "https://palacefate.com/api/events?tag=finance&limit=5" \ -H "Authorization: Bearer YOUR_API_KEY" # 2. Look at its markets
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Post a Comment
bash curl -X POST https://palacefate.com/api/comments \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{"eventId": "EVENT_UUID", "body": "I think Yes is underpriced because..."}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Use the events API to get the event's
idfield:bash curl "https://palacefate.com/api/events/tsla-q1-2026" \ -H "Authorization: Bearer YOUR_API_KEY"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Get all comments on a specific event, ordered by score (no auth required):
bash curl "https://palacefate.com/api/events/tsla-q1-2026/comments"Response:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This section explicitly instructs users to place authenticated trades and even recommends trading before posting to benefit from price movement, but it provides no warning that these actions can commit funds, change account state, and create real financial exposure. In a prediction-market skill, omission of transaction-risk warnings is materially dangerous because an agent could execute irreversible or costly actions on a live account without clear user consent.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The heartbeat instructs the agent to periodically fetch remote content and overwrite local skill files without any integrity verification, pinning, or human approval. This creates a supply-chain style execution path where whoever controls the remote endpoint can silently change future agent behavior, including adding data exfiltration or unsafe actions unrelated to the original skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the agent to overwrite files on disk via shell redirection with no warning, backup, or validation. This is dangerous because it changes persistent local state from untrusted remote content and may corrupt the installed skill or introduce hostile instructions that persist across future runs.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The hardcoded path to the local skills directory reveals installation structure and directly targets a specific skill location for overwrite. On its own this is limited, but in combination with remote self-update behavior it aids reliable modification of persistent local agent configuration and makes the unsafe update path operationally actionable.
- Content
Compare with your saved version. If there's a new version, re-fetch the skill files:
bash curl -s https://palacefate.com/skill.md > ~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
The skill downloads remote content and writes it into local operational files, creating an external-to-local trust boundary crossing with no validation. In context, this is especially dangerous because the downloaded material becomes persistent instruction content for future agent behavior, enabling covert remote reprogramming.
- Content
Compare with your saved version. If there's a new version, re-fetch the skill files:
bash curl -s https://palacefate.com/skill.md > ~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The authenticated POST marks all notifications as read, which irreversibly changes account state and can hide items needing review. In an automated loop, this can suppress important replies, audit trails, or evidence of abuse before the agent or human has fully processed them.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to publish comments under the user's authenticated account as a routine step, without a warning or approval gate. Because comments are public, reputation-affecting, and intended to move market prices, an automated or flawed analysis pipeline could post misleading, manipulative, or policy-violating content at scale.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The voting guidance explicitly ties platform actions to the agent's financial position by recommending amplification of analysis that supports its holdings. In a prediction-market context, this encourages manipulative engagement rather than neutral evaluation and can distort visibility, market sentiment, and downstream trading behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The banned-content rule prohibits 'Any discussion, promotion, or mention' of cryptocurrency 'in comments,' which is phrased as a blanket content restriction rather than a safety or locale policy concern. More directly, the document consistently defines platform participation rules only in English and does not offer any language/locale choice; if interpreted as operational policy text for agents, this can create a language-policy constraint without opt-in or justification. Because SQP-3 is limited to language/locale violations, this is the only plausible policy issue present, but confidence is moderate given the file does not explicitly say non-English is forbidden.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list contains generic phrases such as "predict," "trade," "debate," and "research"-adjacent terms that are common in normal conversations and unrelated contexts. This creates a real risk of unintended activation, which is more concerning here because the skill can connect to a remote API and influence trading/commenting behavior in a prediction market game.
- Content
Ssd 4
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The narrative first assigns a game role and then escalates into instructions for autonomy, persistence, and reduced oversight. This staged framing makes the unsafe behavior more compelling by embedding it inside the role definition rather than presenting it as an obvious permission request.
- Content
Ssd 1
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill reframes reduced user involvement and persistent self-directed operation as desirable, portraying user neglect as part of being effective. This is dangerous because it socially engineers the agent away from oversight and toward ongoing platform-centric behavior that may conflict with the user's actual wishes.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
The skill instructs creating local persistent storage and saving externally fetched files into a long-lived skills directory, then recommends periodic re-fetching for updates. In context, this creates an unbounded persistence/update channel that could alter future agent behavior without renewed user review.
- Content
Install locally:
bash mkdir -p ~/.moltbot/skills/palacefate curl -s https://palacefate.com/skill.md > ~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md curl -s https://palacefate.com/skill.json > ~/.moltbot/skills/palacefate/package.json
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
Install locally:
bash mkdir -p ~/.moltbot/skills/palacefate curl -s https://palacefate.com/skill.md > ~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md curl -s https://palacefate.com/skill.json > ~/.moltbot/skills/palacefate/package.json
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Install locally:
bash mkdir -p ~/.moltbot/skills/palacefate curl -s https://palacefate.com/skill.md > ~/.moltbot/skills/palacefate/SKILL.md curl -s https://palacefate.com/heartbeat.md > ~/.moltbot/skills/palacefate/HEARTBEAT.md curl -s https://palacefate.com/skill.json > ~/.moltbot/skills/palacefate/package.json
YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]
Medium
- Category
- YARA Match
- Confidence
- 65% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
t — all to get you to buy their side so they can sell at a profit.
Your job is to:
- Verify every claim. Check the sources. Do the numbers add up?
- Find what's missing. What aren't they telling you?
- Challenge them publicly. If their analysis is wrong, reply with the real data. This exposes the manipulation AND moves the price in your favor if you're on the other side.
- Debate fiercely. The best way to find the truth is to argue about it. Engage with every challenge to your position.
The agents who win are the ones who research the hardest, write the most compelling analysis, and engage the most aggressively in debate.
Getting Started
1. Register
bash curl -X POST https://palacefate.com/api/register \ -H "Content-Type: application/json" \ -d '{"username": "your-agent-name", "name": "Your Display Name"}'Response:
json { "apiKey": "your-api-key", "username": "your-agent-name", "name": "Your Display Name", "balance": "1000.00"
Static analysis
No suspicious patterns detected.