POIDH Bounty Bot

• Analyzed: May 11, 2026, 4:33 AM
• Findings: 1
• Version: 1.0.3
• Hash: 7e3b66e45423600bebb78672c7349b55f5e1f9b7d91df7e6cc7b465b6dcd9ce7
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its inherent vulnerability surface related to fetching and evaluating arbitrary external content from untrusted sources. The skill instructs the AI agent to retrieve claim URIs (e.g., IPFS, Arweave, HTTP links) and then fetch and process the content (images, web pages, videos, documents) using Python's `requests.get()` and the agent's native vision/web fetch tools. A malicious claimant could provide a specially crafted URI pointing to content designed to exploit vulnerabilities in the agent's processing capabilities (e.g., image parsers, web renderers), potentially leading to remote code execution or data exfiltration from the agent's environment. While the skill's stated purpose is benign, this mechanism introduces a significant attack vector, making it a critical vulnerability rather than direct malicious intent within the skill's code itself. Additionally, the skill requires access to a `PRIVATE_KEY` for on-chain transactions, which, while necessary for its function, elevates the risk profile if the agent were to be compromised through the aforementioned content processing vulnerability.