IFQ App Builder

• Analyzed: May 11, 2026, 2:51 PM
• Findings: 1
• Version: 1.0.1
• Hash: aea767e9900881ba2ea6ab3cb3e506e48306ef32d150ec2354ba33d4bd31e48d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The ifq-app-builder skill is a well-architected tool for generating app-scaffolding prompt bundles with a high degree of built-in security validation. It features internal scanners to prevent secret leaks (scripts/lib/bundle-scanner.mjs), a script safety deny-list that bans dangerous Node.js primitives like eval and child_process (scripts/script-safety-rules.json), and a zero-dependency package.json to mitigate supply chain risks. The instructions in SKILL.md and clawhub.json strictly limit the agent's scope to workspace-only operations and explicitly prohibit the installation of external SDKs or the collection of credentials.