Skill Vetter (by Azhua)

• Analyzed: May 11, 2026, 4:39 AM
• Findings: 1
• Version: 1.0.0
• Hash: c55e636c375a78faf077b4372b5445105738b8bc50857573cb1017d134446693
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'skill-vetter' skill is designed to enhance security by vetting other skills. However, it uses `curl` commands in `SKILL.md` to make external network calls to GitHub APIs (e.g., `api.github.com`, `raw.githubusercontent.com`) to fetch repository information and skill content. While these calls are for the stated purpose of vetting, the skill itself lists 'curl/wget to unknown URLs' and 'Sends data to external servers' as 'RED FLAGS' for other skills. This represents a high-risk capability (external network access) that, despite its current benign use, could be a vector for abuse if the skill's logic were different or compromised. No evidence of malicious intent (e.g., data exfiltration, backdoor installation) was found.