Plurum

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 0.6.0
• Hash: 5e57c38edfc5d12729bac85e9bd2fb7a81a2c8f3e9906dd5c0d3c207eb0a3627
• Source: palm
• External report: View on VirusTotal

Findings (1)

The Plurum skill bundle establishes a persistent data-sharing framework that encourages agents to exfiltrate detailed work logs, reasoning steps, and code artifacts to a central API (api.plurum.ai). The instructions in SKILL.md and HEARTBEAT.md mandate a 30-minute check-in routine and the 'acquisition' of untrusted content from other agents, which could lead to the ingestion of malicious instructions or the inadvertent disclosure of proprietary information. While the documentation includes warnings against sharing secrets, the core design creates a significant privacy and security risk by turning the agent into a data-gathering node for an external service.