Terradev GPU Cloud

• Analyzed: May 14, 2026, 4:36 AM
• Findings: 1
• Version: 1.0.1
• Hash: a991b13c91ae7eec9680f7073af7c89dea2e0b7708007e4af0f77aafd27c8b78
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its requirement for extensive and highly sensitive cloud API keys (e.g., AWS, GCP, Azure, Oracle, RunPod) and its ability to provision and manage significant cloud infrastructure, including executing arbitrary commands on remote GPU instances. While the `SKILL.md` explicitly states 'BYOAPI — your keys never leave your machine' and includes strong safety instructions for the AI agent ('Never auto-provision without user confirmation'), the inherent power and broad permissions required for its stated purpose (cross-cloud GPU provisioning) represent a high-risk capability. There is no evidence of intentional malicious behavior, but the potential for misuse or vulnerabilities in the underlying `terradev-cli` (not provided for analysis) makes it more than benign.