Publisher

• Analyzed: May 12, 2026, 3:03 AM
• Findings: 1
• Version: 1.0.6
• Hash: ead773b51884480f33bd6b0d95500f5bb43af0c63a43446aa4f599e1acadb468
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle's primary purpose is to generate documentation and publish skills to GitHub and ClawdHub, which involves legitimate but high-privilege actions like creating public GitHub repositories and pushing code. However, the `scripts/publish.sh` file contains code that attempts to set a 'reminder' using `cron` if GitHub repository creation fails. While the `cron` job is not fully implemented in the provided code (it only creates a temporary file and echoes a message), the explicit comment `# Note: In production, this would use the cron tool` indicates an intent to use a persistence mechanism, even if for a benign purpose. This design choice, even if not fully realized, elevates the classification to suspicious due to the potential for misuse of persistence.