get-tldr

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 1.0.0
• Hash: 65b2611ef99cfddd0c2ebc33c84049c1e34f87e837b777c73cc5ab7e89f2cb5e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to summarize URLs using the get-tldr.com API. It retrieves an API key from standard configuration locations (~/.config/get-tldr/config.json, environment variable, or .env file) and makes a POST request to the specified API endpoint. The script logs the input URL and the full API response to a local file (~/.config/get-tldr/skill.log by default), which is a common practice for debugging/auditing and not considered exfiltration. The SKILL.md instructions explicitly guide the agent to avoid further summarization or alteration of the API response, acting as a defensive measure against prompt injection. All observed behaviors are aligned with the stated purpose and lack clear malicious intent.