Coding Agent

• Analyzed: Apr 1, 2026, 11:56 AM
• Findings: 1
• Version: 1.0.0
• Hash: feeeebc31430bae7e4985f74e69eef3c840e5f3c4ec92c85dab50bc66042ec6d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides instructions for delegating tasks to external coding agents (Codex, Claude Code, etc.) using high-risk configurations. Specifically, SKILL.md encourages the use of the '--yolo' flag (disabling sandboxes and approvals) and the 'elevated: true' parameter (running on the host instead of a sandbox). While these are presented as features for 'iterative coding,' they allow unvetted third-party agents full, non-interactive access to the host system. No explicit evidence of data exfiltration or intentional malice was found, but the promotion of bypassing security controls for background processes is highly risky.