Türkiye AFAD Deprem

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 0.1.0
• Hash: a71e512268ce235c2e9fe27ad158a153873fe0aaab43c2effe56f2af5b3a3410
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's stated purpose is benign, focusing on fetching and filtering public AFAD earthquake data. The `SKILL.md` explicitly disclaims malicious actions. However, the `scripts/fetch_afad_earthquakes.py` script includes command-line arguments `--source-url` and `--fixture`. These arguments introduce vulnerabilities: `--source-url` could be abused for Server-Side Request Forgery (SSRF) if an attacker can control the URL, and `--fixture` could lead to local file disclosure by reading arbitrary file paths. While these are not inherently malicious code, they represent significant attack surfaces if the AI agent is susceptible to prompt injection, making the skill 'suspicious' due to these exploitable capabilities.