api-test

• Analyzed: Mar 27, 2026, 10:31 AM
• Findings: 1
• Version: 1.0.3
• Hash: e8c16bcdbb21580400665d5cc3803d671464872998314b0a9ad1d81a92b77a5e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a generic HTTP client in 'Skill.py' that allows the agent to perform arbitrary GET and POST requests to any user-provided URL. This implementation lacks any domain whitelisting or input sanitization, creating a high risk for Server-Side Request Forgery (SSRF) attacks against internal or external resources. While the 'SKILL.md' describes the tool as an API documentation assistant, the underlying code is a broad network utility without safety constraints.