Dotfile Sync Manager

• Analyzed: Mar 31, 2026, 4:56 AM
• Findings: 1
• Version: 0.1.0
• Hash: f031ef7335f8ea2ee155b7cc111e5752c5c1e4a2df775e2291ffb6f21014e9e1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle manages sensitive configuration files and synchronization tools (chezmoi, Syncthing, MCP). It contains high-risk capabilities including extracting the Syncthing API key from local XML configs, making local network requests via curl to the Syncthing REST API, and performing destructive actions like stopping system services and deleting database directories (index-v2) for troubleshooting (syncthing.md). While these actions are aligned with the stated purpose of synchronization management and diagnostics, the high level of privilege and potential for misuse of these administrative commands warrants a suspicious classification.