Keychains.dev

• Analyzed: May 12, 2026, 4:20 AM
• Findings: 1
• Version: 1.0.2
• Hash: 5428fb4203d3326dfadf3cf0a4e6ad4f0d379d8629c1f38c52e3b78bbad539e4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its reliance on installing a global npm package (`keychains@latest`) and proxying all API requests through an external third-party service (keychains.dev). While the stated purpose is to enhance credential security, the `npm install` command in SKILL.md represents a significant supply chain vulnerability, as it executes arbitrary code from an external source. Furthermore, routing all API traffic and credential handling through keychains.dev introduces a substantial trust dependency on an external service, which is a risky capability even if its current intent is benign.