Reach

• Analyzed: May 10, 2026, 6:39 AM
• Findings: 1
• Version: 0.2.0
• Hash: d1097287d18740f9a6a536afccb80327ce6fdc4423f1da7fb9b1287d607e6630
• Source: palm
• External report: View on VirusTotal

Findings (1)

The bundle is a high-capability automation framework providing primitives for browser control, crypto-wallet signing, and email management. While it appears to be a legitimate tool for the 'Exoskeleton' agent ecosystem, it possesses high-risk features including session cookie harvesting (src/utils/cookie-import.js), automated CAPTCHA solving (src/primitives/captcha.js), and the ability to sign transactions using a provided private key (src/primitives/sign.js). The 'Remote Inbox' and 'Agent Identity' features rely on external infrastructure (mfer.one), which, combined with the broad web-interaction capabilities, creates a significant attack surface for credential theft or unauthorized financial activity if the agent is misdirected.