Blog to Kindle

• Analyzed: May 12, 2026, 3:07 AM
• Findings: 1
• Version: 1.0.0
• Hash: ae6f7932e8cc270d5ef43c4e5c63c93e30369c50aeccae3585704b873f4fc13c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `osascript` in `scripts/send_to_kindle.py` and `references/manual-workflow.md`. While intended for legitimate email sending via Mail.app, this method is vulnerable to AppleScript injection if the input arguments (file path, email address, subject) are maliciously crafted by a compromised agent. Additionally, `scripts/fetch_blog.py` allows fetching content from arbitrary custom URLs, and `references/manual-workflow.md` demonstrates accessing `GEMINI_API_KEY` from the macOS Keychain, highlighting the agent's broad capabilities, even if for a stated purpose.