x-osv

• Analyzed: May 14, 2026, 6:04 AM
• Findings: 1
• Version: 1.0.1
• Hash: 49f5dfa3af2bd4b6f74e9cacdfe3b5c637a40913c9ec21b22364dde9fea9d37b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is a legitimate CLI wrapper for the Google OSV (Open Source Vulnerabilities) database and the osv-scanner tool. The documentation in SKILL.md and metadata in _meta.json are consistent with its stated purpose of querying package vulnerabilities and scanning local projects, with no evidence of malicious intent, data exfiltration, or prompt injection.