V19 Agent Rating

• Analyzed: May 4, 2026, 11:26 AM
• Findings: 1
• Version: 1.0.0
• Hash: e0722b76aa6a6731aaa430b135dc7a8aa69490cc3c9174485539c124415c6792
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to interact with an external API hosted on a temporary Cloudflare tunnel (boat-atlas-spa-flexible.trycloudflare.com), which is frequently used to bypass firewalls or host ephemeral command-and-control infrastructure. It encourages the agent to perform 'self-registration' and data retrieval using a hardcoded 'governance key' in SKILL.md. While there is no explicit evidence of local data theft or remote code execution, the use of a transient tunnel for a 'governance' and 'rating' system is highly irregular and poses a significant risk of data collection or man-in-the-middle attacks.