XMTP

• Analyzed: May 14, 2026, 3:16 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1ac1aa4ef3eacb87a3bd66fcd4ba7b6a633178b3ab4a5b165950260a750b5ae1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to several high-risk capabilities, although they appear to be aligned with the stated purpose of building an XMTP agent. Key indicators include instructions in `building-agents/rules/setup-environment.md` to run `yarn gen:keys`, which explicitly states it "will append keys to your existing `.env` file," representing programmatic modification of sensitive configuration. Additionally, `handling-attachments/rules/receive-attachment.md` demonstrates the ability to write arbitrary files to the local filesystem via `fs.writeFileSync`, and `managing-groups/rules/welcome-on-install.md` shows the agent modifying group membership based on user input. While these actions are presented as part of the agent's legitimate functionality, they grant significant control that could be abused without clear malicious intent in the provided content.