Session Sync Cloud

• Analyzed: Apr 1, 2026, 7:01 PM
• Findings: 1
• Version: 1.0.0
• Hash: f925dc0c2a17dfc94f441ba462b6b99f81ddfc6c4f30d735c65d6a1ba2a68178
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill documentation (SKILL.md) explicitly claims to provide AES-256 encryption for cloud backups so that the 'server never sees plaintext,' but the implementation in scripts/run.py lacks any encryption logic, uploading memory files in plaintext. This critical discrepancy between the security claims and the actual code behavior creates a false sense of security. Additionally, the generated memory/sync-dashboard.html includes a script that attempts to trigger restores via a local web endpoint (/restore) not implemented in the provided code, which is unusual for a standalone skill.