Satori

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 0.0.1
• Hash: 7d2daeab9751e45e636ca9b7ac5df72adb07b29ff2e12692002fb9e0a9498f82
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its explicit requirement for 'local terminal access' and its instruction to execute external `npx` commands (`@satori-sh/cli`) as detailed in `SKILL.md`. While these capabilities are plausibly needed for its stated purpose of persistent memory, they introduce significant supply chain risk and broad execution permissions. Additionally, `SKILL.md` instructs the agent to 'silently incorporate retrieved context' and 'continue silently (fire-and-forget)' after saving facts, which, while framed for user experience, reduces transparency and could be leveraged as a prompt injection vector to hide malicious actions.