TG Channel Manager

• Analyzed: May 12, 2026, 4:30 AM
• Findings: 1
• Version: 0.0.3
• Hash: ae55aa13213c279de71aefb0e5fc0eab6688b749e8c8530f73f5e54a9068b4a9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several vulnerabilities, primarily the instruction in `references/scout-prompt.md` for the AI agent to "open the source and read its content" from arbitrary URLs found via SearXNG. This exposes the agent to untrusted external web content, creating a significant risk of prompt injection or other exploits against the agent's processing capabilities. Additionally, `scripts/start-searxng.sh` performs a `git clone` and `pip3 install --break-system-packages` from an external repository (github.com/searxng/searxng.git), which introduces supply chain risks and potential system instability. The `curl` command in `scout-prompt.md` to a user-configured `SEARXNG_URL` also presents a potential shell injection vulnerability if the query parameter is not robustly sanitized by the agent.