Agent Reach.Bak

• Analyzed: Mar 23, 2026, 9:11 PM
• Findings: 1
• Version: 1.0.0
• Hash: bd6bb2c05999f6ab8eb869ebf02ceab613dc7d0f6127915d346b72f6377ef3e2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides extensive web-scraping and social media interaction capabilities but introduces significant risk by instructing the agent to fetch and execute installation steps from a remote GitHub URL (install.md) and manage sensitive session cookies for multiple platforms. It utilizes non-standard CLI tools like mcporter and xreach and directs the agent to perform system-level configurations (e.g., proxy settings, package installation) and store persistent data in ~/.agent-reach/, bypassing standard workspace boundaries. The future-dated metadata (2026) in _meta.json is an additional anomaly.