Tamp

• Analyzed: Mar 26, 2026, 2:51 PM
• Findings: 1
• Version: 1.3.0
• Hash: 18f23aba8dc02f323ec03a080435a99414f08762649030b264a6965f4fac5cf6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructions in SKILL.md direct the agent to install a third-party Node.js proxy (@sliday/tamp) and route all Anthropic API traffic, including sensitive API keys, through it. It also establishes persistence by creating a systemd user service (~/.config/systemd/user/tamp.service). While the stated purpose of token compression for cost savings is plausible, the introduction of a Man-in-the-Middle (MitM) component for sensitive credentials and the automated setup of background persistence are high-risk behaviors that warrant caution.