Mxe

• Analyzed: May 12, 2026, 3:32 AM
• Findings: 1
• Version: 2.0.0
• Hash: 356f415afb401ea49d729aecf90d0b6dc871cd290e0e8cc4907d211bab746441
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the instruction in `SKILL.md` for the AI agent to install an external global npm package (`npm i -g @mermaid-js/mermaid-cli`). While `@mermaid-js/mermaid-cli` is a legitimate tool, granting the agent the capability to install arbitrary global packages from the public registry introduces a significant supply chain risk and broad system modification permissions, even without clear evidence of intentional malicious behavior in this specific instance. The skill also demonstrates network access for downloading web articles, which is aligned with its stated purpose.