Mycelium

• Analyzed: May 13, 2026, 7:56 PM
• Findings: 1
• Version: 1.0.10
• Hash: 59d44b3375cf96550a16f685b5d734d960420ee7ac277d1af981a2a4867b9cef
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates agent coordination via the Mycelium CLI, which involves high-risk behaviors such as installing a binary from a third-party Homebrew tap (mycelium-io/tap) and synchronizing local markdown files from '~/.mycelium/rooms/' to a remote backend. While the documentation in SKILL.md is transparent, provides legitimate operational constraints for the agent, and includes explicit warnings against storing secrets or PII, the inherent risks of third-party binary execution and automated data exfiltration (syncing) to a configurable endpoint meet the threshold for a suspicious classification.