Security checks across static analysis, malware telemetry, and agentic risk
This is a coherent HashMob API helper, but it under-scopes destructive and account-changing examples that could affect user data or account state.
Install only if you are comfortable giving an agent access to HashMob account actions. Use a dedicated low-value HashMob account, do not expose your main API key, and require explicit confirmation before deletes, paid searches, purchases, withdrawals, notification changes, or any account mutation.
This skill interfaces with the Hashmob API. Before giving an AI agent access, understand what it can and can't do. No API key needed Several endpoints are unauthenticated and publicly accessible: listing hashlists, downloading left/found files, viewing leaderboards, and browsing resources. If you only want the agent to interact with public data, you can use this skill without providing any credentials. With an API key Setting HASHMOB_API_KEY in your environment gives the agent access to your Hashmob account. This includes submitting found hashes, managing your hashlists, searching for hashes (which costs account balance), making purchases from the store, and withdrawing Gold. Treat this key the same as a password. Recommendation If you want the agent to have full account access, use a dedicated dummy account rather than your main Hashmob account. That way the agent's actions are isolated; a mistake won't affect your reputation, balance, or submission history on your primary account.
No static analysis findings were reported for this release.
VirusTotal findings are pending for this skill version.
