Yandex Tracker CLI

• Analyzed: May 12, 2026, 4:13 AM
• Findings: 1
• Version: 1.2.8
• Hash: 878e6cdea59f942d280d9927fd1b74d1faea1158d02cbdcb38966853710310e5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The yandex-tracker-cli skill is a legitimate Bash-based CLI for interacting with the Yandex Tracker API. The script (yandex-tracker.sh) implements robust security practices, such as safe parsing of configuration files without using 'eval' or 'source', and includes manual path validation logic to prevent path traversal during file uploads and downloads. Furthermore, the SKILL.md file contains explicit safety instructions for the AI agent, specifically forbidding access to sensitive system directories like ~/.ssh or /etc.