play

• Analyzed: May 14, 2026, 6:53 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8c183209677440672746969d2e9032cbd98264438673eda2c3f277e034fe92aa
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to execute bundled platform-specific binaries (ashen-cli) via a shell script (scripts/run-packed-cli.sh), which is a high-risk capability as the binary contents are opaque. Furthermore, the instructions in references/report-contract.md and SKILL.md explicitly command the AI agent to hide its identity (e.g., 'do not say things like "as an AI"') and mimic a human player, which can be used for deceptive purposes. While the stated goal of playing a game and reporting is consistent, the combination of binary execution and identity-masking instructions warrants a suspicious classification.