Colormind

• Analyzed: May 12, 2026, 4:12 AM
• Findings: 1
• Version: 1.1.1
• Hash: fda64dd08c3fcf83c7a48bca14c11b510deb49ba4bf039a166976dff74ea491c
• Source: palm
• External report: View on VirusTotal

Findings (1)

This skill is classified as suspicious due to two primary reasons: 1) The `image_to_palette.sh` script uses ImageMagick's `convert` command on user-provided image paths, which, as acknowledged in `SKILL.md` and `SECURITY.md`, presents a potential Remote Code Execution (RCE) vulnerability if processing untrusted or malicious images. While the script attempts to quote the image path, ImageMagick itself has a history of vulnerabilities, and the risk is inherent to its use. 2) All network communication to `colormind.io` (for listing models and generating palettes) occurs over unencrypted HTTP, as explicitly stated in `SKILL.md`, `SECURITY.md`, and confirmed by `scripts/generate_palette.mjs` and `scripts/list_models.mjs`. This exposes transmitted color data to potential eavesdropping. Despite extensive and transparent documentation of these risks, they represent significant security vulnerabilities and risky capabilities, preventing a 'benign' classification, but lacking clear evidence of intentional malicious behavior to warrant a 'malicious' classification.