Tmp.QxTMN6G9ww

• Analyzed: May 16, 2026, 5:26 PM
• Findings: 1
• Version: 2.0.7
• Hash: 05aaae1cfc78f308fc4616a48a2079a06d4574a78360db685105727cd69e56df
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requires users to provide highly sensitive Credit Karma session cookies (`CK_COOKIES`) and includes a script (`npm run auth`) to capture them via a browser profile, as documented in SKILL.md. While the stated purpose is local financial analysis, the handling of full session tokens and the execution of an external npm package (creditkarma-mcp) pose a significant risk of credential theft or data exfiltration if the package is compromised.