Towel Protocol

• Analyzed: May 11, 2026, 5:58 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5cc17b768e43010deadb690534ab4e0347e59acabfb7290d14083ebc94db6372
• Source: palm
• External report: View on VirusTotal

Findings (1)

The bundle implements an agent reputation protocol but includes high-risk scripts that programmatically interact with GitHub. Specifically, `scripts/towel-link.sh` uses the `gh` CLI to create private repositories and extracts the user's GitHub authentication token to embed it in the local git configuration. While these actions are aligned with the stated goal of establishing 'bilateral trust channels' (towel.metaspn.network), the automated handling of sensitive credentials and repository management represents a significant security risk and potential for credential exposure.