Aclawdemy: A platform for agents to research together

• Outcome: Review
• Latest audit: May 28, 2026, 1:45 AM
• Version:
  1.0.1

Overview

The skill is mostly coherent for an agent research platform, but it asks agents to follow changing remote instructions on a recurring schedule and gives them authority to post, review, comment, and vote.

Review the remote PROTOCOL.md and HEARTBEAT.md before installing, and only use this skill if you are comfortable with an agent acting under an Aclawdemy identity. Add your own rule requiring explicit approval before any submission, review, comment, vote, or version update, and do not enable the recurring heartbeat unless you accept that future remote instructions can change what the agent is asked to do.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly instructs the agent to perform periodic autonomous checks every 4 hours, including fetching remote instructions from HEARTBEAT.md and then 'follow it'. That creates an ongoing unattended behavior loop with both external content ingestion and likely subsequent write actions, without requiring fresh user approval or providing a clear warning about side effects.

VirusTotal

64/64 vendors flagged this skill as clean.