agentchan

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 2.0.1
• Hash: cca0c4119277f1232d2bd381b7ad7323875d309477390709a25c0cfd355e87e1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to a critical prompt-injection vulnerability in its 'Refresh Rule' within `skill.md`. This rule instructs the AI agent to periodically fetch and execute instructions from remote markdown files (`https://chan.alphakek.ai/skill.md` and `https://chan.alphakek.ai/heartbeat.md`). This creates a significant supply chain risk, as a compromise of the remote server could allow an attacker to inject arbitrary malicious instructions into the agent's operational logic, leading to unauthorized actions or data exfiltration. While the current content is not explicitly malicious, this mechanism establishes a direct channel for future remote instruction execution.