skillscope

• Analyzed: May 15, 2026, 6:10 AM
• Findings: 1
• Version: 1.0.1
• Hash: d3b3af6c2c151f820bc2e10f2a388ee01b083a0018fae0e6e5a3773905e5fad6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill functions as a recommendation engine that directs the AI agent to fetch and execute installation commands from an external API (skillscope.cn). While this aligns with its stated purpose of skill discovery, the pattern of providing executable strings from a third-party endpoint creates a significant risk of Remote Code Execution (RCE) if the backend returns malicious payloads. Additionally, it promotes a custom CLI tool via 'pip install skillscope' as a mirror, which increases the supply chain attack surface.