Skill Gitee

• Analyzed: Apr 2, 2026, 8:46 AM
• Findings: 1
• Version: 1.1.1
• Hash: d899ddb72bd4c1673c82535178738b087b0478465e6bc259c2bb2ac331c73309
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a framework for agents to log learnings and errors to markdown files for continuous improvement. It is classified as suspicious due to a significant mismatch between its stated purpose and its metadata configuration in SKILL.md, which includes instructions to install an unrelated third-party binary (gogcli via steipete/tap/gogcli). This installation is not aligned with the 'Self-Improvement' functionality or the 'skill-gitee' slug defined in _meta.json, suggesting either a high-risk copy-paste error or an attempt to bundle unrelated software. While the core logic and the extract-skill.sh script (which includes path-traversal safeguards) appear functionally benign, the unexplained inclusion of external binary dependencies is a red flag.