vet

• Analyzed: May 11, 2026, 4:35 AM
• Findings: 1
• Version: 0.2.4
• Hash: 97962f9c2aa72d92bcf76d52715a8cdfd4616d8cc72102e3dee46936a9e58600
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its broad capabilities, including shell execution, file system access, and network interactions, which, while plausible for its stated purpose (code review), introduce significant attack surface and supply chain risks. Specifically, `SKILL.md` instructs the agent to install packages from PyPI and update skill files from `https://github.com/imbue-ai/vet`, and `scripts/export_opencode_session.py` executes the external `opencode` binary via `subprocess.run`. These operations involve trusting external binaries and remote sources, which could be exploited if compromised, even though there is no clear evidence of intentional malicious behavior within the provided files.