Public APIs Skill Creator

• Analyzed: May 12, 2026, 4:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: b1d2a7c15827f9e0684fb111e13b5fda403ed5c1ef664b5a56602e63a65f6d93
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to multiple critical shell injection vulnerabilities (RCE risks) and prompt injection risks. Specifically, `scripts/create_skill.sh` directly interpolates user-controlled input (like API URLs and descriptions) into generated shell scripts and markdown files without proper sanitization, allowing for arbitrary command execution and prompt injection in the newly created skill. Similarly, `scripts/gen_usage.sh` and `scripts/solve_task.sh` (especially with the `--try` flag) directly interpolate API URLs into `curl` commands, creating shell injection vulnerabilities that could lead to RCE if exploited by a malicious input or a compromised API source.