Locus

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 1.3.0
• Hash: 20ceb4c3149e0833cae96878f0d4d7788ee7ccbd98151faa66129251a58d6486
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to enable AI agents to perform crypto payments, which inherently involves high-risk operations. It installs a global package (`mcporter`) via `npm i -g` in `SKILL.md` and `scripts/setup.sh`, requiring elevated privileges. It also handles sensitive API keys for a payment service (`https://app.paywithlocus.com`) and implies access to email for payment processing. While the `SKILL.md` includes strong safety rules for the agent (e.g., 'Never send payments without explicit user confirmation'), the combination of global package installation, sensitive credential handling, and direct financial transaction capabilities without clear malicious intent pushes it into the 'suspicious' category due to the broad permissions and inherent risk.