Gamma App API

• Analyzed: May 14, 2026, 7:18 AM
• Findings: 1
• Version: 1.0.1
• Hash: fd0c43c0171cc273c91cbd2317cff4ead3601de175a9877f65abe88449b7cdb8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a significant security vulnerability in `scripts/gamma.sh` where user-provided input (e.g., `--instructions` or the main input text) is directly interpolated into a `python3 -c` command string. This pattern allows for arbitrary Python code execution (RCE) if a user provides input designed to break out of the Python string literals. While this appears to be a poorly implemented JSON generator rather than intentional malware, the risk of exploitation is high. All network activity is correctly restricted to the official `public-api.gamma.app` endpoint.