Selection Agent

• Analyzed: Mar 29, 2026, 3:51 PM
• Findings: 1
• Version: 1.0.0
• Hash: 48a68c42a1789f281a03303c095d6553eb912c4dedb1a68fdc9a9ed75b672b28
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains highly risky instructions in SKILL.md that direct the AI agent to execute a Python script from a temporary directory (/tmp/powerful-trendplus/scripts/run_full_research.py) and source local environment variables (.env.local). It explicitly mentions that sensitive tokens and API keys (Semrush, FB_ADS_TOKEN, NOTION_API_KEY, GEMINI_API_KEY) are stored in these local files. While these behaviors facilitate arbitrary code execution and potential credential access, the lack of the actual script payload or explicit exfiltration logic makes it impossible to confirm malicious intent versus extremely poor security practices for a research tool.