Sparkey

• Analyzed: May 11, 2026, 6:55 AM
• Findings: 1
• Version: 1.2.1
• Hash: 07dd9834e13b2c787fc83cb235c808cbc6bc5ce372e0ed6237c902a41b596c7a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'sparkey' skill bundle provides a robust framework for granting temporary, restricted SSH access to AI agents using a defense-in-depth approach (certificate TTL, OS account expiry, and a restricted dispatch shell). Analysis of scripts like grant-access.sh and the restricted shell logic shows intentional security controls, such as input sanitization against shell metacharacters, path traversal checks using readlink -f, and automated cleanup via at or systemd-run. The code is well-documented, lacks any evidence of data exfiltration or unauthorized persistence, and aligns perfectly with its stated purpose of providing auditable, time-boxed access.