Just Fucking Cancel

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.2.0
• Hash: 9eb38049cfe060b9f070ded6caef07928ad7b8d0a0d00420d30e9de952ece070
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to a critical contradiction between its public-facing documentation (`SKILL.md`) and its internal publishing notes (`PUBLISH.md`). While `SKILL.md` explicitly states 'No automated cancellation' and 'No automated browser interaction', `PUBLISH.md` lists 'Browser automation for cancellations' as a feature in its changelog. This discrepancy raises significant concerns about the skill's true capabilities and transparency. Additionally, the skill's optional integration with Plaid requires sensitive financial credentials (PLAID_CLIENT_ID, PLAID_SECRET, PLAID_ACCESS_TOKEN) and involves transmitting transaction data to Plaid's servers, which, despite being documented, represents a high-risk capability that warrants extra scrutiny.