nadfun

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7107be88eb6da4b855c8fca21d43a9cac0b30bce9946f32e9483687a48ccf9cb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the presence of `curl` commands in `SKILL.md` that instruct the AI agent to download additional skill files from a remote domain (`https://nad.fun`) and save them to the local filesystem (`~/.nadfun/skills/`). While these commands appear to be for modular skill loading or updates, they introduce a supply chain risk, as the integrity of remotely fetched content cannot be guaranteed. This represents a risky capability without clear malicious intent, aligning with the 'suspicious' threshold.