Chromecast With Google Tv

• Analyzed: May 12, 2026, 3:36 AM
• Findings: 1
• Version: 1.2.0
• Hash: 3b2482c87acf692c4399b077c2807908a1cce2806f4686bc64aae4b1f1f4d7c1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a significant remote shell injection vulnerability in `google_tv_skill.py`. The `handle_tubi` function passes user-supplied URLs directly to `adb_intent_view`, which then executes an `am start` command via `adb shell` on the remote Android device. A malicious user could craft a Tubi URL containing shell metacharacters (e.g., `https://www.tubitv.com/foo"; rm -rf /sdcard`) to execute arbitrary commands on the connected Chromecast device. While the skill's stated purpose is legitimate device control and there is no clear evidence of intentional malicious design, this vulnerability allows for unauthorized remote code execution on the target device.