Wayfinder

• Analyzed: May 14, 2026, 3:58 AM
• Findings: 1
• Version: 0.0.4
• Hash: 2972aed637d81e06e82fff3deb42f4fc13912f994c0ec7f7ce47c0fd32e58601
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to its broad `network` and `filesystem` permissions, and the inherent high-risk nature of its DeFi trading and asset management capabilities, which involve handling private keys and executing on-chain transactions. While the `SKILL.md` documentation includes extensive safety instructions for the AI agent (e.g., 'NEVER output private keys', 'Require explicit user confirmation', 'ALWAYS search first for token IDs') and the `run_script` command is explicitly sandboxed to `.wayfinder_runs/`, the underlying power of these operations, including the use of `git checkout` in helper scripts (`scripts/pull-sdk-ref.sh`, `scripts/sync-skill-json-from-sdk.py`) for SDK management, presents significant potential for misuse or exploitation if environmental controls or agent safeguards are insufficient. There is no clear evidence of intentional malicious behavior within the provided files.