Tailscale

• Analyzed: May 12, 2026, 3:03 AM
• Findings: 1
• Version: 1.0.0
• Hash: dc0d57029153ac1f4e98daf37d6a4914b76eb7420ac7b1b0e46ecb03b835b298
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides extensive capabilities for managing a Tailscale network, including file transfer (`tailscale file cp`), public service exposure (`tailscale funnel`), creation of API keys (`ts-api.sh create-key`), and authorization/deletion of devices (`ts-api.sh authorize`/`delete`). While these are legitimate administrative functions of Tailscale, they represent high-risk capabilities that, if misused by a malicious user or a compromised agent, could lead to significant harm (e.g., data exfiltration, unauthorized network exposure, creation of backdoors). The `SKILL.md` and `scripts/ts-api.sh` files themselves do not show clear evidence of intentional malicious behavior or prompt injection attempts; they correctly implement the stated purpose. However, the inherent power and potential for misuse of these capabilities classify the skill as suspicious rather than benign.