Synth Data

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 1.1.5
• Hash: 3eeaf34fa28f8cd449e0b9efd2dc1f6e75ecc2129e6efd2e8a80ab6f639510e3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. It queries volatility forecasts from the legitimate `api.synthdata.co` API using an API key from environment variables. The `scripts/synth.py` uses standard Python libraries (`urllib.request`, `os`, `argparse`) for network communication and command-line argument parsing. There is no evidence of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or prompt injection attempts against the AI agent in any of the documentation or code files. All network calls are directed to the hardcoded `api.synthdata.co` domain, and the code is clear and readable.