Workspace Explorer

• Analyzed: May 12, 2026, 3:21 AM
• Findings: 1
• Version: 1.1.5
• Hash: f723377062af4dacfdbb7a44a2560f16a179b56d4c149ecb28a439e287b3989f
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is suspicious due to its high-risk capabilities, despite aligning with its stated purpose. It instructs the agent to download and execute external binaries (code-server and cloudflared) from an external GitHub repository (https://github.com/mrbeandev/workspace-explorer.git) as described in SKILL.md, which introduces a significant supply chain risk. Furthermore, it creates a public internet tunnel via Cloudflare to expose the agent's workspace, providing remote interactive access, which is an inherently high-risk operation. While the prompt instructions in SKILL.md and HEARTBEAT.md are aligned with the skill's function (sharing the URL/password, checking status), the underlying actions carry substantial security implications.