Risha.ai Content Generation

• Analyzed: May 14, 2026, 12:26 PM
• Findings: 1
• Version: 1.0.0
• Hash: c1a99236063c06357b49da68f634b3ebf6a24713fd694a06a52d2621837f19cd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive interface for the Risha.ai API, but it is classified as suspicious due to the presence of 'risky capabilities' and a minor vulnerability in the helper script (scripts/risha_api.py). The script performs network requests to an external domain (adminxcore-api.risha.ai), handles sensitive credentials from environment variables, and includes functionality to write files to the local system. Specifically, the 'catalog' command lacks path sanitization for its output flags (--write-json and --write-markdown), which represents an arbitrary file write vulnerability that could be exploited via prompt injection. While these capabilities are plausibly needed for the skill's stated purpose and no intentional malice was detected, they meet the threshold for a suspicious classification under the provided criteria.