Preqstation

• Analyzed: May 12, 2026, 4:30 AM
• Findings: 1
• Version: 0.1.8
• Hash: 192c6333a6bfd6a2bafca1ef6fd5ac8a40d52c96c55c9c57929734c996231885
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill automates coding tasks using external CLIs (Claude, Codex, Gemini) and explicitly instructs the agent to use high-risk flags such as '--dangerously-skip-permissions' and '--dangerously-bypass-approvals-and-sandbox' to bypass interactive security prompts during background execution. While SKILL.md implements safety mitigations like mandatory git worktrees and directory blacklisting (e.g., ~/clawd/), the intentional bypass of underlying tool sandboxes and the use of background PTY sessions for arbitrary code modification represent significant high-risk capabilities.