spots

• Analyzed: May 15, 2026, 3:03 AM
• Findings: 1
• Version: 0.2.0
• Hash: 0db5851f156d3abac7e2a6fb131fd4af2d756aa5ceff29b08c13e1806c6fea92
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to two high-risk capabilities outlined in `SKILL.md`. First, the `go install github.com/foeken/spots@latest` instruction involves downloading and executing code from a remote source, which introduces a supply chain risk. Second, the `op://Echo/Google API Key/credential` instruction directs the agent to interact with a credential manager (1Password) to retrieve a sensitive API key. While these actions are presented as necessary for the skill's stated purpose, they represent powerful capabilities that could be exploited under different circumstances, thus exceeding the threshold for a benign classification.