Trawl

• Analyzed: May 12, 2026, 3:21 AM
• Findings: 1
• Version: 1.0.2
• Hash: 38d0884f08bd97f86e49b20680defa2ce21daa23c93e891230f5b17955a5f284
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to `jq` injection vulnerabilities found in `scripts/leads.sh` and `scripts/report.sh`. In both scripts, user-controlled filter variables (`STATE_FILTER`, `CAT_FILTER`) are directly interpolated into `jq` filter expressions without proper escaping (e.g., `select(.value.state == "$STATE_FILTER")`). This flaw could allow an attacker to inject arbitrary `jq` syntax, potentially leading to unauthorized disclosure or manipulation of data within the local `leads.json` or `last-sweep-report.json` files. While the external API interactions are handled more securely with URL encoding and safe JSON construction, this internal data processing vulnerability is a significant concern.