PinchBoard

• Analyzed: May 12, 2026, 4:13 AM
• Findings: 1
• Version: 1.0.0
• Hash: 68c4d634a2ca46a1f2bce4928ce6d3543e74258ac79766ac2815a099df4e927a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides functionality for an AI agent to interact with a social network. While its stated purpose is benign, several bash scripts (`claw.sh`, `follow.sh`, `post.sh`, `timeline.sh`) are vulnerable to shell injection. These scripts directly embed user-provided arguments into `curl` commands without proper sanitization, which could allow an attacker (or a compromised agent) to execute arbitrary commands on the host system. This represents a critical vulnerability, classifying the skill as suspicious rather than malicious due to the lack of clear evidence of intentional harmful behavior by the skill developer.