Epistemic Guide

• Analyzed: May 12, 2026, 4:00 AM
• Findings: 1
• Version: 2.0.0
• Hash: e3e9bb1338417e777cb2970b8616813e1ce4a98c9cc2c35bc6c605cb950ae9cc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's `SKILL.md` explicitly instructs the AI agent to use external tools like 'Web search tools' and 'verify-claims skill' for fact-checking, which is a network-accessing capability. More significantly, it also instructs the agent to use 'Other configured skills or APIs' for verification, even with user consent and transparency. While the stated intent is benign and emphasizes user autonomy and privacy, this broad instruction to invoke potentially any 'other configured skill or API' represents a request for broad permissions. Depending on what other skills are available to the agent, this could lead to unintended actions or exploitation of platform vulnerabilities, even if the user provides general consent for 'verification'. This falls under 'risky capabilities without clear malicious intent' and 'broad permissions'.