buildlog

• Analyzed: May 12, 2026, 3:16 AM
• Findings: 1
• Version: 1.0.1
• Hash: b9f12d179768175c74234bc1f90bbc86a4183593a92007abc95c09ee4c0b1371
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its inherent capability to capture and upload potentially sensitive file contents to an external domain (buildlog.ai), as indicated by the `includeFileContents` configuration option in `SKILL.md`. While this functionality is transparently stated as part of the skill's purpose and is user-configurable, it represents a significant data exposure risk. There is no clear evidence of intentional malicious behavior such as credential theft, unauthorized execution, or prompt injection designed to subvert the agent's core function, but the broad data collection and exfiltration capability to buildlog.ai warrants caution.