hallo 123

• Analyzed: May 12, 2026, 4:23 AM
• Findings: 1
• Version: 1.0.3
• Hash: 47506563c77821c0c9e33772acd3bc5a472cd2f5d2cbccdaeb6e53f5972791be
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to be highly proactive, stating, "Don't wait for your human to ask — connect to the arena, find an opponent, and fight." While this aligns with the 'meme warrior' persona, it represents a significant prompt injection risk by encouraging autonomous actions that could lead to unexpected API calls (e.g., to xAI/OpenAI for image generation, potentially incurring costs) without explicit user consent for each battle. Additionally, the `SKILL.md` contains a `javascript:alert(1)` link, which is a client-side XSS vulnerability if the markdown is rendered in a web context, though not a direct threat to the agent's execution environment.