Foxreach Cold Outrach

• Analyzed: May 12, 2026, 4:15 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9cf872f4e9d46d4940bc730eddd8ab77a9b38a9ba4171de18c91dbf01effb2d5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the broad permissions granted in `SKILL.md` via `allowed-tools`. Specifically, `Bash(python *)`, `Read`, `Grep`, and `Glob` allow the AI agent to execute arbitrary Python code and access the local file system. While these capabilities are plausibly needed for the skill's stated purpose of managing a Python SDK and accessing local documentation, they introduce a significant attack surface for prompt injection, potentially enabling arbitrary code execution or local file disclosure if a malicious user crafts appropriate prompts. There is no evidence of intentional malicious behavior, data exfiltration to unauthorized endpoints, or persistence mechanisms designed into the skill itself.