Apple Calendar Manager

• Analyzed: May 11, 2026, 4:42 AM
• Findings: 1
• Version: 1.0.0
• Hash: b489837eea7d101ec0565b6d2f7688b63be22c2e647fd0d5f457b3a3548e2939
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `parse_relative_date.sh` script contains a critical shell injection vulnerability. The `RELATIVE_DATE` argument is directly interpolated into the `date -v"next $RELATIVE_DATE_EN"` command without proper sanitization or quoting, allowing an attacker to inject arbitrary shell commands via command substitution or command separation. This flaw could lead to arbitrary code execution on the host system when the `add_event_smart.sh` skill is invoked with a specially crafted `RELATIVE_DATE` argument.