Stashdog

• Analyzed: May 12, 2026, 4:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: fc32ace7b147426c6d4a3b9120cb081f77e7de10ff59a51e528d99faa2421291
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `npx` in `SKILL.md` to download and execute the `mcp-remote` package from the npm registry. While this action is intended for connecting to the specified MCP server, executing remote code via `npx` introduces a supply chain risk, as the `mcp-remote` package itself could be compromised. There is no evidence of intentional malicious behavior within the skill's instructions or configuration.