Agent Touch Layer

• Analyzed: May 14, 2026, 3:33 AM
• Findings: 1
• Version: 0.1.0
• Hash: d37c649539b312b4c543d908d50265cec532eac8217b0bab51b7b114f23a4c89
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to its reliance on an external GitHub repository for core functionality and the use of powerful system commands. The `scripts/setup.sh` file performs a `git clone https://github.com/JordanCoin/Atl` and then builds and installs the application using `xcodebuild` and `xcrun simctl install`. This introduces a supply chain risk, as the integrity of the external repository is critical. Additionally, the `SKILL.md` documentation explicitly details the `evaluate` command, which allows arbitrary JavaScript execution within the simulated browser, a powerful capability that could be exploited if the agent is compromised.