Readwise & Reader API

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 1.0.0
• Hash: fd83bf13a27e5dc1bf1352d88c25419a05bb25c0a15744e1dc22c56474c19f39
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is benign. The `SKILL.md` provides clear instructions for using the Readwise API via the `scripts/readwise.sh` script, without any prompt injection attempts or instructions for the agent to deviate from its purpose. The `readwise.sh` script correctly uses `curl` to interact with the legitimate `readwise.io` API endpoints, requiring only the `READWISE_TOKEN` environment variable for authentication. JSON payloads are safely constructed using `jq --arg` to prevent injection, and there is no evidence of unauthorized data exfiltration, malicious execution, persistence mechanisms, or obfuscation.