Video Editing Agent (VEA)

• Analyzed: May 11, 2026, 4:37 AM
• Findings: 1
• Version: 1.1.2
• Hash: 238d7b9efe57ab02b220ffad57b3b2526a7905807a8092433d924402fe8557cb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the use of `curl -LsSf https://astral.sh/uv/install.sh | sh` in `SKILL.md` for installing the `uv` package manager. While a common installation method for legitimate tools, this practice executes arbitrary remote code, posing a significant supply chain risk if the remote server were compromised. Additionally, `SKILL.md` instructs the agent to perform `gcloud auth application-default login`, granting sensitive access to Google Cloud resources, and API keys are stored locally and loaded into environment variables, which is a standard but vulnerable practice. There is no evidence of intentional malicious behavior like data exfiltration to unauthorized endpoints or stealthy backdoors.