AgentKey — Full internet access for your AI agent

• Analyzed: May 6, 2026, 2:20 AM
• Findings: 1
• Version: 1.2.1
• Hash: 221e147e976638ec19be3296cc9c85aca191478a1fb147a5a1e950ec73566de0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a high-privilege 'Step 0' in SKILL.md that forces the agent to execute a shell script (check-update.sh) on every invocation. It also uses 'npx' to download and execute code for authentication and updates, and explicitly instructs the agent to modify sensitive configuration files (e.g., ~/.claude/settings.json, ~/.cursor/mcp.json). While these behaviors are aligned with the stated purpose of managing an MCP server, the combination of automated shell execution, configuration modification, and instructions to bypass built-in agent tools creates a significant security surface.