Golang

• Analyzed: May 14, 2026, 6:59 AM
• Findings: 1
• Version: 2.0.1
• Hash: d617d9fe29415ebe8a3912ad7221e3b094f2a3b588aba5c96a57a3dfb03476c6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a logging utility for Go development activity, but it contains several security flaws. The `_search` function in `scripts/script.sh` is vulnerable to argument injection because the `$term` variable is passed unsanitized to `grep`, potentially allowing an attacker to use flags like `-f` to read arbitrary local files. Additionally, the `_export` function fails to escape user-controlled input when generating JSON and CSV files, leading to data integrity issues or injection risks if the output is processed by other tools. The `SKILL.md` description is also misleading, as it claims to build and lint Go projects while the implementation only records text entries to local logs.