mx-auto

• Analyzed: May 10, 2026, 6:45 AM
• Findings: 1
• Version: 1.0.2
• Hash: 4994a9e55ace1d6f1a4a32b4b55026588529e48b5c09147bcb656bbf81b7efff
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to manage and execute automation triggers but contains high-risk behaviors, specifically the automated discovery and reading of administrative tokens from the local filesystem (e.g., 'runtime/admin-token.json') and environment variables (MX_APP_RUNTIME_ADMIN_TOKEN). While these capabilities are plausibly required for the stated purpose of RPA integration, the automated credential harvesting and the inclusion of a cloud dispatching script (cloud_dispatch_loop.sh)—even if currently marked as reserved—represent a significant security surface. Additionally, the logic in scripts/run.sh and scripts/local_dispatch_loop.sh could be vulnerable to token exfiltration if an agent is manipulated into using an attacker-controlled base URL.