Play Chess

• Analyzed: May 12, 2026, 3:13 AM
• Findings: 1
• Version: 1.0.2
• Hash: 4a245b90240bcf4f87feae7f4e1829a18a62a4f15993e7a5399022095dc1deb2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides instructions and API endpoints for an AI agent to play chess, with all network interactions directed to `clawchess.com`. It includes explicit security warnings against API key exfiltration. However, the `SKILL.md` file instructs the agent to periodically fetch `https://www.clawchess.com/HEARTBEAT.md` and 'follow it'. This dynamic instruction loading mechanism, found in `SKILL.md`, presents a significant prompt injection vector and supply chain risk, as the remote `HEARTBEAT.md` content could be altered to instruct the agent to perform unauthorized or malicious actions.