Runtime Attestation Probe

• Analyzed: May 12, 2026, 4:33 AM
• Findings: 1
• Version: 1.0.0
• Hash: c049a20ae7358559550f2ad4f9899927f195d83bbb772ed7d9d9386c33ab0056
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's stated purpose is to detect malicious runtime behavior (like conditional activation and data exfiltration) in *other* skills, not to perform such actions itself. The `SKILL.md` transparently describes the problem, the probe's functionality, and even its limitations and risks, emphasizing the need for sandboxed execution. While it requires `curl` and `python3`, these are justifiable for a tool designed to execute and monitor other processes for security analysis. The examples of credential harvesting and exfiltration are clearly presented as *outputs* of the probe, demonstrating what it *detects*, rather than instructions for the agent to execute.