xenodia

• Analyzed: May 11, 2026, 5:03 AM
• Findings: 1
• Version: 1.0.0
• Hash: aee8e7c864ccc5579a8d9d29343fae8d6c849d305c26ed07a9b6702c202ce241
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to two significant vulnerabilities related to sensitive credential handling and persistence. Firstly, the `SKILL.md` explicitly instructs the AI agent to persist sensitive Coinbase CDP API keys and wallet secrets in plaintext within the user's `~/.zshrc` file. This makes these critical credentials broadly available in every new shell session, significantly increasing their exposure. Secondly, the `xenodia_client.py` script stores the agent's local EVM private key in a plaintext file named `.xenodia_agent_key` within the skill's directory. While these actions are for the agent's stated functionality and convenience, storing private keys and API secrets in plaintext files and shell configuration files without explicit security measures (like restrictive file permissions) constitutes a high-risk vulnerability, even if not directly malicious in intent.