Agent manager

• Analyzed: May 14, 2026, 3:13 AM
• Findings: 1
• Version: 1.0.2
• Hash: 2d537b72a6481896feb739659016df54bc2e271359867d0cf73d632785a831d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle's Node.js scripts primarily handle local file operations for agent configuration. However, the `agent-registry.md` and other documentation (e.g., `task-routing-rules.md`) explicitly declare that the 'main' agent, which this skill manages, possesses extremely broad and powerful capabilities. These include arbitrary shell command execution (`exec, process`), network access (`web_search, web_fetch`), browser control (`browser`), persistence (`cron`), and the ability to spawn and control other agents (`sessions_spawn, sessions_send`). While these capabilities are plausibly required for an agent management skill, their extensive nature introduces significant security risks, even without explicit malicious intent found in the skill's direct instructions or code.