Remove Analytics

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 0.1.0
• Hash: 6da7ff7d2567f3459556f3a0810a51cbc42f182e8bfcb49e1277c65490268177
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to remove Google Analytics from a project, which inherently requires file system modification (read, write, delete) and command execution (e.g., `npm uninstall`). While these are high-risk capabilities, the `SKILL.md` instructions are transparent, explicitly require user confirmation before proceeding, and consistently align with the stated purpose. The `disable-model-invocation: true` flag further mitigates prompt injection risks by preventing the agent from invoking its own model for arbitrary actions. There is no evidence of intentional malicious behavior such as data exfiltration, unauthorized access, or obfuscation.