Crypto Wave Scanner

• Analyzed: May 14, 2026, 4:49 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8bd39fba82534979ae46b04f88584e2d4b80a4be89336a38a31bb6f7c45901bb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to a shell injection vulnerability in `scripts/wave_scanner.py`. The `curl_get` function uses `subprocess.run(['curl.exe', '-s', BASE + path])` where `path` is constructed using the `sym` variable. If a user provides a crafted `--symbols` argument (e.g., `BTCUSDT --output /tmp/foo`), it could lead to arbitrary command execution via `curl.exe`. While this is a critical vulnerability, there is no evidence of intentional malicious behavior (e.g., data exfiltration, persistence) within the provided code, aligning it with a 'suspicious' classification rather than 'malicious'.