skill-state-manager

• Analyzed: May 11, 2026, 3:54 AM
• Findings: 1
• Version: 0.0.1
• Hash: 22ec7873b5fef0b2ed3bdfcb13624415ab2f49be0bba505809d1e6e5bfca6e86
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'skill-state-manager' skill (SKILL.md) acts as a meta-tool that instructs the AI to intercept authentication failures from other skills and prompt the user to provide sensitive credentials (API keys, tokens) directly within the chat interface. It then directs the AI to store these secrets in plaintext JSON files at predictable local paths, such as `~/.ai-skills-state/` or `~/.claude/skills-state/`. While presented as a convenience for managing tool state, this pattern introduces significant security risks by centralizing unencrypted secrets in well-known locations and encouraging insecure secret-handling practices.