Skillboss

• Analyzed: May 11, 2026, 6:03 AM
• Findings: 1
• Version: 1.0.0
• Hash: d6aa134610eba4e317b4454e7a3dff1050ecbc373af94f5bfee15a77f38b7bc1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a CLI interface for an external AI service (heybossai.com). While the code in scripts/run.mjs and scripts/auth.mjs appears to be a functional API wrapper, the documentation (chat-models.md, image-models.md) lists numerous non-existent or future-dated models such as GPT-5, Claude 4.6, and Gemini 3. This deceptive advertising suggests the service may be a front for harvesting user prompts and data. Additionally, the tool's ability to read local files and send them to the API (e.g., for STT tasks in run.mjs) poses a risk of data exfiltration if the agent is prompted to process sensitive files.