Buzz BD

• Analyzed: May 14, 2026, 4:18 AM
• Findings: 1
• Version: 1.0.0
• Hash: 730a11da19b3f1c633dbe9324cdfe3cd8676f3ff6bcb49bcb4f351b9ce39878d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a critical shell injection vulnerability in `scripts/eliza-adapter.mjs`. The `BUZZ_TOKEN_INTELLIGENCE` action uses `child_process.execSync` to call `scripts/buzz-scan.mjs`, directly embedding user-controlled input (`message.content.text`) into the shell command string without proper sanitization or escaping. This allows an attacker to execute arbitrary commands on the host system by injecting shell metacharacters into the token name or address. While this is a severe vulnerability, there is no clear evidence of intentional malicious behavior (e.g., data exfiltration, persistence) designed into the skill itself, classifying it as suspicious rather than malicious.