Skillnote

• Analyzed: May 13, 2026, 4:11 PM
• Findings: 1
• Version: 0.5.3
• Hash: d05283a18699f61ccdede941215f467dae132fbaf9adbb71afa70702c22811af
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a self-hosted registry and analytics system with several high-risk behaviors: a background daemon (log-watcher.py) that parses all agent session logs, and a self-update mechanism in sync.sh that can overwrite the skill's executable logic and AI instructions (SKILL.md) from a remote server. While the bundle includes extensive transparency documentation (SECURITY.md) and requires user consent for initial setup and backend installation, the automated execution of a log-monitoring daemon and the ability to perform remote code/instruction updates represent a significant security surface that could be repurposed for data exfiltration or instruction injection.