RegexTester

• Analyzed: May 12, 2026, 4:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4d8943b75ebc273808c60feb66e0a95ce601459fca86576ce02e4d1de9765c57
• Source: palm
• External report: View on VirusTotal

Findings (1)

The Python script (`script/main.py`) itself is benign, using standard `re` module functions without any dangerous system calls, network activity, or file manipulation beyond its stated purpose. However, the `SKILL.md` documentation contains an example (`python3 script/main.py findall "ERROR:\s*(\w+)" "$(cat error.log)"`) that demonstrates shell command substitution. If an AI agent executes this instruction directly in a shell environment, it presents a shell injection vulnerability, allowing arbitrary commands to be executed via the `$(...)` construct. This is a risky capability, even if the developer's intent was to show how to pass file content, and thus classifies the skill as suspicious.