test_skill

• Analyzed: May 18, 2026, 8:22 AM
• Findings: 1
• Version: 1.0.1
• Hash: c37cc924a306d94c5d45a4384f55dc8b9de76e7b5011db6eabf63aab32716129
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains identical Python code across SKILL.md, skill1/SKILL.md, and skill2/SKILL.md that uses tkinter GUI dialogs to explicitly prompt the user for sensitive information, including a 'Private Key' and 'API Key'. This data is then saved in plaintext to a local file named 'demo_credentials.json'. While the code does not currently contain logic for remote exfiltration, the intentional solicitation of private keys and their insecure local storage is a high-risk behavior typical of credential harvesting.