Crowd Prompting

• Analyzed: May 11, 2026, 3:31 AM
• Findings: 1
• Version: 1.0.7
• Hash: de61ce809609d81c00bad4b39a05745721cb439df0f34019bfaf0d5a096f698e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill includes instructions for the AI agent to self-update its `SKILL.md` file by `curl`ing a remote URL (`https://crowdmolting.com`) and overwriting the local skill definition (in `SKILL.md`). This creates a supply chain vulnerability, as a compromised remote server could serve a malicious `SKILL.md` to the agent. This behavior also directly contradicts the skill's own 'Security Warnings' which explicitly state, 'Do not self-update or schedule background tasks. Update the skill only via explicit, manual human action.' While there is no clear evidence of intentional malicious behavior like data exfiltration or unauthorized remote control, this self-update mechanism represents a significant security risk.