Literature Manager

• Analyzed: May 12, 2026, 4:11 AM
• Findings: 1
• Version: 1.1.1
• Hash: a8d91970dbadeaf17cd0323d5b95f5c920202b6a6c1f753feba7a8ca10634757
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to two factors: 1) The `SKILL.md` explicitly instructs the AI agent to set up and manage `cron` jobs for monitoring and re-spawning other agents. While framed as a reliability feature, this grants the agent the capability to interact with system-level persistence mechanisms, which is a significant security risk and a potential prompt-injection vector if exploited. 2) The `scripts/download.sh` script and `SKILL.md` openly include `sci-hub.box` as a download source. While declared, connecting to a service known for copyright infringement introduces a connection to a potentially untrusted third-party domain, which carries inherent risks. There is no clear evidence of intentional malicious behavior like data exfiltration or unauthorized remote control, but these capabilities represent high-risk behaviors.