pensieve-algorand

• Analyzed: May 11, 2026, 4:58 AM
• Findings: 1
• Version: 3.0.0
• Hash: b1a7dce875cc70e64fd822a8c4d1e566d19bdd2a5873522ca1fafb4bf08333f3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a sophisticated long-term memory system that anchors encrypted data to the Algorand blockchain. While the code in 'server.py' appears functionally aligned with its stated purpose and includes robust integrity checks (AES-GCM, zlib compression, and hash-chaining), it requires high-sensitivity credentials—specifically a 25-word Algorand mnemonic—to be stored in environment variables or local files. Although the script uses these credentials only to sign self-transactions for data anchoring and does not show evidence of intentional exfiltration, the management of private keys within an AI agent's execution environment is a high-risk capability that warrants caution.