Security Analyst

• Analyzed: May 18, 2026, 5:56 AM
• Findings: 1
• Version: 1.0.1
• Hash: adc432f377f5fd85f27634dba28a42b1140b67defa73c572456fbeaf8123f146
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is designed for comprehensive offensive security analysis, requiring broad read/write access to the project workspace and the ability to execute shell commands (e.g., `git log`, `npm audit`). It explicitly states it will read sensitive files (including environment and secrets files), generate proof-of-concept exploits, and write these artifacts to disk. While these capabilities are high-risk and could be misused, the skill's documentation and agent prompts consistently frame these actions as part of a legitimate security audit, instructing agents to 'discover and report on' credentials and to 'redact the actual secret' in findings. There is no clear evidence of intentional harmful behavior such as exfiltrating data to arbitrary external endpoints, installing backdoors, or executing malicious remote payloads. The prompt injection examples found in `attack-surface-llm.md` and `cicd-pipeline.md` are for the agent to *identify* in the target codebase, not to execute against the user's environment. The classification is 'suspicious' due to the inherent high-risk nature of its declared capabilities and broad permissions, which, if misinterpreted or subtly altered, could lead to unintended consequences, rather than clear malicious intent.