Update Plus

• Analyzed: May 12, 2026, 3:10 AM
• Findings: 1
• Version: 4.0.3
• Hash: 92f513d8b70dac479a411fcccc4302e1b2a8ab115ecacc4fc644e974ff3be1bd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill 'update-plus' provides comprehensive backup, update, and restore functionalities, utilizing powerful system commands like `rsync`, `tar`, `gpg`, `rclone`, `git`, package managers (`npm`, `pnpm`, `yarn`, `bun`), and `crontab`. While these capabilities are plausibly needed for its stated purpose (e.g., file system access for backups, network access for updates/cloud sync, cron for scheduled tasks), they represent high-risk operations. Specifically, the installation of a cron job (`bin/lib/cron.sh`) creates a persistence mechanism, and the use of `eval` with `rsync_args` (`bin/lib/backup.sh`) introduces a minor risk, even if driven by user configuration. There is no clear evidence of intentional malicious behavior or prompt injection against the agent, but the broad permissions and high-risk capabilities without explicit malicious intent warrant a 'suspicious' classification.