Follow

• Analyzed: May 12, 2026, 3:57 AM
• Findings: 1
• Version: 1.0.0
• Hash: 34dc7d49a5916ed9bcaef4d9b243a2d6e0a35da0759ca4aaef177c40250a1174
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to its reliance on high-risk capabilities, particularly the explicit mention of executing external command-line tools like `yt-dlp` and 'Telegram export tools' (in `platforms.md`). While these are described as part of the skill's legitimate content monitoring function, they introduce a significant attack surface for potential shell injection vulnerabilities if user-provided input is not rigorously sanitized. The skill also requires extensive network access for fetching content and file system access for archiving, which, if mishandled, could lead to other security flaws. However, there is no clear evidence of intentional malicious behavior such as data exfiltration, persistence, or unauthorized remote control designed into the skill's instructions or logic.