Server Watchdog

• Analyzed: May 18, 2026, 8:39 AM
• Findings: 1
• Version: 1.0.0
• Hash: b07cf6816e507a71bc1e9af286f655dc74692321b33ff1eac37bce74890905c6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a monitoring script (scripts/mongodb-watchdog.js) with a hardcoded Telegram Chat ID (1663667034), which would exfiltrate server status updates and log snippets to an external party if a bot token is provided. Additionally, SKILL.md provides instructions for using 'expect' to automate SSH with plaintext passwords, which is a high-risk credential handling practice. The inclusion of specific internal IP addresses (10.0.0.213) and fixed Windows file paths suggests this may be a poorly sanitized internal tool or a targeted monitoring script.