Social Trend Report

• Analyzed: May 12, 2026, 4:32 AM
• Findings: 1
• Version: 0.1.0
• Hash: cfee126a97ae31deb33f6df07d3b27d74a2e91e60d1ae18e993ac4652a83df9c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to a shell injection vulnerability in `scripts/collect.sh`. The `bird search "$kw"` command directly embeds user-controlled keywords from `config.json` without proper sanitization, allowing for arbitrary command execution. Additionally, the skill requires sensitive Twitter authentication cookies (`AUTH_TOKEN`, `CT0`) and is configured to perform external network requests and potentially announce reports to Discord, which are high-risk capabilities, though aligned with its stated purpose.