Social Sentiment

• Analyzed: May 12, 2026, 3:52 AM
• Findings: 1
• Version: 1.4.0
• Hash: 1ec15e9a1dd7ac6137c02c3ae34a37bb660f6387b7d2f5be210fb54d25fd1a95
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its instruction to install the `mcporter` binary via `npm` in `SKILL.md`. Installing packages from `npm` can execute arbitrary code during the installation process, posing a significant supply chain risk. While the skill's stated purpose and network interactions with `mcp.xpoz.ai` appear legitimate, the reliance on installing and executing an external binary via a package manager introduces a critical vulnerability that could be exploited for malicious purposes.