Cloud Misconfig Scanner

• Analyzed: Mar 21, 2026, 8:16 AM
• Findings: 1
• Version: 1.0.0
• Hash: 74fda22215f8737c4c8a37cd17321dda48807835fed4d3f0c745cd1f41217815
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle facilitates a 'Cloud Misconfiguration Scanner' that requires the agent to collect and transmit raw cloud provider credentials (e.g., AWS Access Key ID and Secret Access Key) to a third-party API endpoint (api.mkkpro.com). While this behavior is explicitly documented in SKILL.md and openapi.json as necessary for the tool's stated purpose, the practice of sending long-lived, highly sensitive secrets to an external service represents a significant security risk. There is no evidence of obfuscation or hidden malicious intent, but the inherent risk of credential handling justifies a suspicious classification.