Web3 Target Team Research

• Analyzed: May 12, 2026, 3:05 AM
• Findings: 1
• Version: 1.0.1
• Hash: 236331ed2ef024042081232d784bd0172671ffcc8a98feacc1e0d3e7761890d1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its aggressive use of agent capabilities and potentially problematic file access instructions. It explicitly sets up a cron job and modifies HEARTBEAT.md for continuous, 24/7 auto-respawning of subagents, which is a form of persistence. It also instructs the agent to use a 'screenshot' capability for Telegram profile verification, a high-risk action. Furthermore, the `references/workflow.md` file contains hardcoded absolute paths (`/Users/derrick/clawd/crypto-master.csv`) for reading and writing data, which, while targeting the skill's own data files, could lead to unintended behavior or write attempts outside the designated workspace if the agent's environment differs from the hardcoded path.