Listenhub

• Analyzed: May 11, 2026, 4:48 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5f04071e9b3d54e9d05f83094fc6c6b4bb17e120785daeb4acb4c1e30dae5622
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains several security vulnerabilities. The `scripts/lib.sh` and `scripts/generate-image.sh` files use `eval "$(grep 'export VAR_NAME' ...)"` to load environment variables, which is a shell injection vulnerability if a user's shell configuration file is compromised. Furthermore, `scripts/lib.sh` includes an auto-update mechanism that downloads and executes new scripts directly from `raw.githubusercontent.com`, introducing a supply chain risk. While the `SKILL.md` provides strong prompt injection defenses for the AI agent and most scripts use `jq` for robust input sanitization, these flaws allow for potential attacks, classifying the bundle as suspicious.