Fix NPM Vulnerabilities

• Analyzed: Mar 31, 2026, 11:36 AM
• Findings: 1
• Version: 1.0.1
• Hash: d82e439e4601721061a044264b402576f4f7f5ce8df8540b5930c42a22a1a225
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md file contains instructions that direct the AI agent to perform silent global installations of software (e.g., 'npm install -g <tool>') without seeking user confirmation. While the stated intent is to facilitate npm vulnerability remediation using tools like 'snyk' or 'pnpm', the instruction to bypass user consent for system-level changes is a significant security risk that could be exploited to install arbitrary packages. This behavior qualifies as a high-risk vulnerability/pattern rather than confirmed malice.