Usdc Hackathon

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 1.0.15
• Hash: 3d2727f6febdceaa959ecb164fa6b7b128f9b43c89204f80d064275a60bf14da
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to instructions that grant the AI agent high-risk capabilities, specifically file system access to sensitive data and broad network access, even though these are presented with defensive security measures. SKILL.md instructs the agent to read and write to `~/.gitpad_password` for authentication, and all track files (`tracks/COMMERCE.md`, `tracks/CONTRACT.md`, `tracks/SKILL.md`) instruct the agent to perform network requests to external public domains (e.g., `github.com`, `gitpad.exe.xyz`, block explorers, and arbitrary API endpoints) for verifying third-party submissions. While the skill includes extensive and explicit warnings against prompt injection, mainnet usage, and credential exfiltration, the inherent capability to access local sensitive files and make unconstrained network requests to public domains for verification constitutes a meaningful high-risk behavior.