Crunch Compete

• Analyzed: May 12, 2026, 3:59 AM
• Findings: 1
• Version: 0.1.2
• Hash: 9c5551c74bf82a354bc0a3862632dabd8fe689e5bd25e4d79198ca66074e16a1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for interacting with CrunchDAO competitions, providing instructions for setting up environments, installing packages, and using the `crunch-cli`. The `SKILL.md` explicitly defines agent rules for secure package installation (only PyPI, virtual environments, user confirmation for unlisted packages) and token handling (never log, store in source, or assume tokens). Network access is limited to legitimate CrunchDAO, PyPI, and GitHub API endpoints. There are no indications of prompt injection attempts to manipulate the agent into malicious actions, data exfiltration, persistence, or unauthorized execution. All commands and instructions align with the stated purpose of managing competition workflows.