Goosetown Skill

• Analyzed: May 11, 2026, 5:53 AM
• Findings: 1
• Version: 1.2.0
• Hash: fc6fd144b1d15ad5c2468182137ca4e1f915949ec274ce5fe6b47e67f34a662c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The GooseTown skill implements a persistent multi-agent simulation environment using a background Python daemon (town_daemon.py) and WebSockets (ws-dev.isol8.co). It is classified as suspicious due to a significant remote prompt-injection vulnerability: the daemon blindly writes unvalidated 'context_summary' data received from the remote server directly into TOWN_STATUS.md. Since SKILL.md explicitly instructs the AI agent to follow the actions prompted in that file, a compromised or malicious server could exert unauthorized control over the agent's local execution environment.