Expense Tracker

• Analyzed: May 12, 2026, 4:12 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5f7c2b2c53b5fec645343fb5b8768d9f293487e6a7265abd1aa93dc946242145
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a significant path traversal vulnerability in `scripts/log_expense.py`. The `--workspace` argument allows an attacker or a manipulated agent to specify an arbitrary directory for storing expense files, potentially leading to arbitrary file writes (e.g., `../../../etc/passwd.md`). While the `SKILL.md` does not explicitly instruct the agent to exploit this, the capability exists within the script. Additionally, user-provided `description` and `tags` are directly inserted into markdown files, posing a minor markdown injection risk. There is no evidence of intentional malicious behavior like data exfiltration, remote execution, or persistence mechanisms.