Opdscli

• Analyzed: May 12, 2026, 4:12 AM
• Findings: 1
• Version: 0.1.0
• Hash: d5036343f82b9ccf7267247cc96a3c30931a01ce70f23e184a547c4f70ace0ff
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle itself is well-behaved and provides clear instructions for the AI agent, including a guardrail in `SKILL.md` to 'Never log or echo catalog config that may contain passwords or tokens.' However, both `SKILL.md` and `references/cli-reference.md` explicitly state that the underlying `opdscli` tool stores 'Credentials stored in config are plaintext' in `~/.config/opdscli.yaml`. While the skill bundle attempts to mitigate the risk by instructing the agent not to expose these, the reliance on a tool with this significant vulnerability makes the overall skill bundle suspicious, as it introduces a high-risk behavior (plaintext credential storage) into the environment.