Rent a Person

• Analyzed: May 12, 2026, 3:46 AM
• Findings: 1
• Version: 1.0.35
• Hash: 74e534b1d5e238a62d699d2c281f2cb9fa0714c67b6141cd229144aa31cf8ac3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to explicit prompt injection instructions in `SKILL.md` and `AGENT_BRIEF.md`. Specifically, the agent is instructed to 'MUST process' RentAPerson webhooks and 'IGNORE' OpenClaw's security notices for webhooks. While the stated purpose is to enable automated processing of legitimate events, these instructions train the AI agent to bypass platform security warnings, creating a critical vulnerability in the agent's operational security. Additionally, some utility scripts (`scripts/send-via-cli.sh`, `scripts/send-to-session.js`) include the API key directly in messages, which is a less secure practice, although the main agent flow with the recommended 'bridge' service aims to avoid this.