Table Image

• Analyzed: May 13, 2026, 3:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: c6cb59649b6983a6a3ddd9f6360a6cd0c27fe22ce034b5292fa0fcd71b744a85
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the agent to install an external Go binary (`tablesnap`) from GitHub using `go install`. While this action is plausibly needed for the skill's stated purpose, it introduces a significant supply chain risk by fetching and executing code from an external, potentially untrusted source. This grants the agent broad capabilities (network access, file system write, arbitrary code execution) without clear malicious intent within the `SKILL.md` instructions themselves, classifying it as suspicious rather than benign.