Zulip

• Analyzed: May 12, 2026, 4:09 AM
• Findings: 1
• Version: 1.0.2
• Hash: 24e453ac283e742e76bd51151b361e447f796d7929f66689cab8e5aeeea106d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is primarily benign, providing legitimate interaction with the Zulip API. However, it is classified as suspicious due to the inclusion of `curl` examples in `SKILL.md` and `references/api-quick-reference.md` that directly embed API keys in the command line (`-u "[e-mail]:KEY"`). While common in API documentation, this practice poses a vulnerability risk as API keys could be exposed in process lists or shell history if an agent were to execute these commands directly without proper sanitization or secure credential handling, potentially leading to information leakage. There is no evidence of intentional malicious behavior or prompt injection attempts against the agent.