Pa Onboarding

• Analyzed: Apr 2, 2026, 9:47 PM
• Findings: 1
• Version: 1.1.1
• Hash: 2c0fee91c380315a0b5d50d689253f0687992a5d9302737a27640102a3a59f0e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle facilitates the onboarding of a personal assistant with broad access to sensitive data, including Gmail, Google Drive, and Calendar. It explicitly instructs the agent to store a monday.com API token in a plaintext file at `~/.credentials/monday-api-token.txt` (SKILL.md), which is a significant security vulnerability. While these high-privilege capabilities and shell-based credential management (using the `gog` utility) are aligned with the stated purpose, the lack of secure secret handling and the request for extensive OAuth scopes represent a high-risk profile.