Safe Skills

• Analyzed: May 14, 2026, 3:11 AM
• Findings: 1
• Version: 1.0.0
• Hash: 377ce947c8599490ea5de2d6fc1347d1fdc396c2276c17fd5b5fa0f11437c63e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for secure secret management, specifically for EVM wallets, where the AI agent never directly accesses raw secret values. The `SKILL.md` explicitly instructs the agent 'Never attempt to access or request raw secret values,' which is a defensive prompt injection. All operations involve standard API calls to a specified external service (`https://safeskill-production.up.railway.app`) using `curl`, without any evidence of data exfiltration, malicious execution, persistence mechanisms, or other harmful behaviors. The instructions are clear, transparent, and align with the stated purpose of managing an EVM wallet through a secure intermediary.