along-plan

• Analyzed: Mar 31, 2026, 3:46 AM
• Findings: 1
• Version: 1.0.0
• Hash: 25875338029035c743f5d7e4d3cc2ffd28cb98ba46ad17af0f059e17b41ad127
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle defines a 'Plan Mode' that purports to be read-only but includes high-risk commands in its 'safe' allowlist within `references/safe-commands.md`, specifically `env`, `printenv`, `curl`, and `wget`. While the instructions in `SKILL.md` focus on safe exploration, the inclusion of these tools allows an agent to access sensitive environment variables and exfiltrate data to external endpoints via GET requests. This configuration presents a significant security risk by providing the necessary primitives for data exfiltration under the guise of a restricted planning environment.