CAN: Clock Address Naming

• Analyzed: May 12, 2026, 3:38 AM
• Findings: 1
• Version: 1.9.0
• Hash: 6a9f826fc7d57a9ecc998f06a15ce10d71410aaf7518c79256d5d728949ac93c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` primarily defines a local logging and verification mechanism using standard utilities (`date`, `sha256sum`, `awk`, `echo`) to append to `~/.can/index.tsv`, which is benign. However, the `README.md` includes a 'use case' example that demonstrates an agent using `curl` to fetch data from `api.example.com` and subsequently storing the *full content* of that response in `~/.can/store/$WHERE`. While `api.example.com` is a generic placeholder and the action is presented as an example, the inclusion of a network call (`curl`) and the storage of arbitrary remote content in a documentation file (which an AI agent might interpret as executable instructions) introduces a significant risky capability. This capability could be exploited for data exfiltration or remote code execution if the agent were prompted to fetch from a malicious URL or if the stored content were later executed, thus classifying the bundle as suspicious due to this vulnerability risk.