Portfolio Risk Analyzer

• Analyzed: May 15, 2026, 3:16 AM
• Findings: 1
• Version: 0.1.0
• Hash: 528c1e311f5cf456cdaa4e39fbfb10fa07e66127eac9b67a235231f72d7d54ae
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to its direct handling of a private key (`PAYMENT_WALLET_KEY`) for fund management and its use of `child_process.execSync` to execute shell scripts from the Node.js server. The `SKILL.md` and `README.md` explicitly instruct users to provide a private key as an environment variable, which is then used by `scripts/execute-buyback.sh` to perform Uniswap swaps. The `server.js` file schedules a cron job that uses `execSync` to run this script hourly. While these actions are central to the skill's stated purpose of automated token buybacks, they represent significant risky capabilities that could be exploited if the environment or skill were compromised, even without clear evidence of intentional malicious behavior in the provided files.