Knowledge Habit Skill

• Analyzed: May 11, 2026, 6:42 AM
• Findings: 1
• Version: 1.0.9
• Hash: 435748db55984f191ce344c07ec77d6de5f15b26bf62d82cfe49d43eaf18a52d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill functions primarily as a downloader/installer that fetches external code from a GitHub repository (github.com/puppetcat-fire/knowledge-habit-tracker.git) and executes it via 'npm install' inside 'install.sh'. This pattern is risky because the core logic of the application is not contained within the analyzed bundle, bypassing static analysis. Additionally, 'install.sh' uses interactive shell prompts and performs symlink operations ('ln -sf') based on user-provided paths, which could lead to local file system manipulation if exploited.