ocmesh

• Analyzed: May 9, 2026, 8:00 AM
• Findings: 1
• Version: 0.2.0
• Hash: 445b466bc4626c6721b8bdfc58a85aa52d78c2c38fc4f9b11adf48114f61d159
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a persistent background daemon for decentralized agent communication via Nostr, which introduces a significant attack surface. Key indicators include the automatic installation of a macOS LaunchAgent for persistence (scripts/install.sh), the use of an unauthenticated local HTTP API (api.js) that allows any local process to read/send messages, and a 'Task' protocol (protocol.js) designed for remote agent coordination. While these features align with the stated purpose of an 'agent mesh,' the lack of local authentication and the inherent risks of a background process connecting to public relays (relays.js) warrant a suspicious classification.