MALP

• Risk level: Low
• Analyzed: Apr 24, 2026, 7:06 PM
• Findings: 0
• Version: 0.1.3

Overview

This is an instruction-only skill that consistently documents reading and maintaining local .malp/ directories and a user-local index (~/.malp-home), and it does not request credentials, install code, or call external endpoints.

This skill appears internally consistent and low-risk: it only works with local `.malp/` directories and a user-local index under `~/.malp-home`. Before installing or invoking it, consider: (1) the skill will read and may write files under `~/.malp-home` and any project path you explicitly tell it to `send malp to`; ensure those paths don't contain secrets you don't want read/written; (2) it will not access network services or require credentials; (3) the manifest did not declare config paths even though the instructions reference `~/.malp-home/*` — that's expected here but worth noting; (4) follow the guidance in the skill about adding `.malp/` to your gitignore if you don't want those files committed. If you want the agent to take any actions (creating or refreshing a `.malp/`), make those requests explicit rather than relying on automatic behavior.