Skill Box

• Analyzed: Apr 1, 2026, 4:16 AM
• Findings: 1
• Version: 1.0.4
• Hash: 3acd47ede5a1eb852be58339b265d3adbe2163c351c76e80f7aea05a153ad516
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'digital-life' skill bundle requests high-privilege permissions, including 'Bash' and 'browser(profile="user")', to scrape sensitive personal data from authenticated social media sessions (WeChat, Weibo, GitHub, etc.). While the stated intent is philosophical 'digital archaeology' and the instructions in SKILL.md and the layer0/ files emphasize local processing and privacy, the capability to programmatically access logged-in browser profiles and manage local files represents a significant security risk. No explicit evidence of malicious exfiltration or backdoors was found, but the broad access to private user data and system tools fits the criteria for a suspicious classification.