AI Opportunity Scout

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2c2e3ce85c12ed837caad3fbfcd1c1bb64759556198046b0f35830d0d607822c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to the potential for shell injection. The `SKILL.md` instructs the AI agent to execute external commands (`bird search` and `clawdhub search`) via `exec`, passing user-controlled input (`[niche]`) directly into these commands. If the `bird` or `clawdhub` tools, or the agent's `exec` mechanism, do not properly sanitize this input, a malicious user could craft a `niche` string to execute arbitrary shell commands. This represents a significant vulnerability, even though the skill itself does not demonstrate explicit malicious intent like data exfiltration or backdoor installation.