Bob P2P - Beta

• Analyzed: May 15, 2026, 3:21 AM
• Findings: 1
• Version: 1.0.1
• Hash: 61312d5655fb6b1b915dc258a5d75f8b90e12af87bd2b9ca926d84344ee036ed
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its direct handling of cryptocurrency private keys, external code fetching, and extensive network communication. The `SKILL.md` and `scripts/setup.sh` explicitly instruct the user to provide a Solana wallet private key, which is then stored in `config.json` and used by `client/src/solana/index.js` to sign and send transactions. The `scripts/setup.sh` also performs a `git clone` from `https://github.com/anthropics/bob-p2p-client.git`, introducing a supply chain risk. Furthermore, the client makes numerous HTTP requests to external aggregators (e.g., `http://bob-aggregator.leap-forward.ca:8080`) and the Solana mainnet RPC (`https://api.mainnet-beta.solana.com`), and establishes P2P connections, representing broad network access. While these actions are necessary for the stated purpose of a decentralized API marketplace, they represent significant security risks without clear malicious intent within the provided code.