test

• Analyzed: May 12, 2026, 3:10 AM
• Findings: 1
• Version: 1.0.0
• Hash: 20c517f17a5c61bf89ea1887608581759261b8e1f0b8f2d387b346da68a0e543
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the instruction in `SKILL.md` to load and apply user customizations (PREFERENCES.md, configurations, or resources) from `~/.claude/skills/CORE/USER/SKILLCUSTOMIZATIONS/RedTeam/`. This creates a significant prompt injection and local file inclusion vulnerability, allowing an attacker or user to inject arbitrary instructions or configurations for the agent to execute. Additionally, `SKILL.md` demonstrates local network communication capabilities via a `curl` command to `http://localhost:8888/notify`, which, while currently used for benign notifications, represents a risky capability.