Claude Buddy Card

• Analyzed: May 10, 2026, 6:28 AM
• Findings: 1
• Version: 1.1.0
• Hash: 0a39d36e21d0ddd5ee4e0d18c8c9b48f10cc18f8c59d8bb23b96f2bab83133a2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill extracts sensitive Claude OAuth tokens directly from the macOS Keychain using the 'security' command and uses them to query the Anthropic API for the user's account UUID. While the stated purpose is to generate a deterministic 'Buddy Card' using a local algorithm (scripts/buddy-algorithm.js), the programmatic extraction of live credentials is a high-risk behavior that could be easily repurposed for exfiltration. No evidence of intentional data theft was found, but the reliance on Keychain access and the 'leaked source' narrative warrant caution.