Locu

• Analyzed: May 12, 2026, 3:19 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9bd1b759ebc0587ff34bb1b7282e8861a1d4b6b56b6173cc8fb99edf2cf3840c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. It defines a skill to interact with the Locu Public API, making standard `curl` GET requests to `https://api.locu.app` endpoints using a `LOCU_API_TOKEN` provided via environment variables, as declared in `SKILL.md`. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or harmful prompt injection against the agent. All actions are consistent with the stated purpose of managing tasks and projects via the Locu API.