Agent Orchestrator

• Analyzed: Apr 30, 2026, 9:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: e2dbe3d837665ef05eb7a5e6c9b67283ba7c7a8403f8fb91692c71b3b185a649
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle functions as an agent orchestrator but exhibits several high-risk indicators. It references external Python scripts (scripts/create_agent.py, scripts/dissolve_agents.py) that are not provided in the bundle, and it hardcodes a requirement to transmit data and an environment variable (SKILLBOSS_API_KEY) to a specific third-party domain (api.heybossai.com) across SKILL.md and its templates. Furthermore, the _meta.json file contains a future-dated timestamp (2026), which is often a sign of synthetic or deceptive metadata. While these capabilities are plausibly related to its stated purpose, the lack of transparency regarding external scripts and the mandatory external API dependency pose a security risk.