Translink CLI

• Analyzed: May 11, 2026, 4:34 AM
• Findings: 1
• Version: 1.0.1
• Hash: 3244399f9cecdb62ca47f234ceeac954901747d51de78253d9cd899c046061cd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to interact with a local CLI tool (`translink_*` commands). It is classified as suspicious due to two main reasons: 1) The `SKILL.md` references a GitHub repository URL (`https://github.com/alanburchill/traslink-cli-scripts`) with a typo (`traslink` instead of `translink`), which represents a typosquatting supply chain risk. While the agent is instructed to 'stop and ask the user to install it first', this is still a significant vulnerability if the user or agent misinterprets the instruction. 2) The skill describes CLI commands with numerous parameters (e.g., `--where field=value`, `--contains field=text`) in `references/commands.md` and `SKILL.md`. If the AI agent constructs these commands by directly interpolating user input without proper sanitization, it could lead to shell injection vulnerabilities, allowing arbitrary command execution on the host system. These are vulnerabilities rather than explicit malicious intent within the skill bundle itself.