Setup Agent

• Analyzed: May 14, 2026, 6:22 AM
• Findings: 1
• Version: 0.2.0
• Hash: 61a842e790689205d581a2f8f607b531b14b57c363fca132a82a176af8ad51f3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill automates API key configuration for the Karma platform by making network requests to gapapi.karmahq.xyz and modifying user shell configuration files (.zshrc, .bashrc) to persist credentials. While these actions are aligned with the stated purpose of an authentication setup and the instructions include a step to ask for user permission, the direct modification of shell profiles and the handling of sensitive API keys via shell scripts represent high-risk capabilities.