Tmp.Qs5EOZDgAo

• Analyzed: May 15, 2026, 11:06 PM
• Findings: 1
• Version: 1.1.0
• Hash: dc69f9f0b6ca9f1bb45122b564f3443603fb248c00c458a8d52f20c9ae85675d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The zola-mcp skill (SKILL.md) manages sensitive wedding data, including guest addresses and budgets, and utilizes a browser-automation script to extract session cookies (JWTs) for authentication. While these capabilities are plausibly needed to interface with the Zola mobile API, the handling of PII and the use of 'npx' for remote execution represent high-risk behaviors under the provided criteria. No clear evidence of intentional malice or prompt injection was found, but the authentication method and broad data access are inherently risky.