yapp

• Analyzed: Apr 3, 2026, 2:41 AM
• Findings: 1
• Version: 1.0.3
• Hash: 39621af60455ef90b8f28d91120d213af46038bbbf0c652e69896aa19747681b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requests a 'Yapp' API key and communicates with a generic-looking endpoint (yyy-production.up.railway.app) to fetch voice transcripts. While the instructions in SKILL.md align with the stated purpose of a journaling integration, the requirement to poll the external service on every heartbeat and the use of a placeholder-style domain for a production service are potential indicators of data harvesting or excessive data exposure.