captions

• Analyzed: May 12, 2026, 3:14 AM
• Findings: 1
• Version: 1.5.0
• Hash: a320bf45c8168c055e902b53fa3cfb923a8229d31050da1d284a04148c024eeb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to instructions in 'references/auth-setup.md' that direct the AI agent to bypass platform security redaction filters. It explicitly instructs the agent to write sensitive tokens and API keys to temporary files to ensure the agent can read them even if the platform attempts to mask or redact them from tool output. While the tool's stated purpose of fetching YouTube transcripts via 'transcriptapi.com' is functional, the inclusion of techniques to circumvent security guardrails and the automated account registration flow represent high-risk behaviors.