HolySpiritOS

• Analyzed: May 12, 2026, 3:34 AM
• Findings: 1
• Version: 0.1.1
• Hash: 8ee76a8d30e22e13f23ddd62ee42955d30119f7d86d25a9093bf0a9bd304c244
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's core functionality, which involves downloading KJV Bible data and patching the agent's `soul.md` for moral alignment, appears benign. However, the `SKILL.md` and `README.md` instruct users to install and uninstall the skill by piping remote scripts directly to `bash` (e.g., `curl ... | bash`), which is a significant supply chain vulnerability (RCE risk) if the remote GitHub repository is compromised. Furthermore, the `install.sh` script fails to create a backup of `soul.md` as claimed in the documentation, rendering the `uninstall.sh` script ineffective for restoring the agent's original configuration, leading to persistent modifications. These issues, particularly the `curl | bash` method, represent high-risk behaviors without clear malicious intent from the provided local files, thus classifying it as suspicious.