System Monitor Pro

• Analyzed: May 11, 2026, 4:53 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6927c20c9d78743b9c5b419aa3db089f0695d3498b730562dddd84905ce331c3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `monitor.js` script contains a critical shell injection vulnerability (Remote Code Execution) in the `remoteRun` function. The `remoteHost` variable, derived directly from user input via `process.argv`, is used unescaped within an `ssh` command executed by `execSync`. This allows an attacker to inject and execute arbitrary commands on the local machine running the skill. Additionally, the `SKILL.md` instructions for `--remote user@host` present a prompt injection risk if the agent does not properly sanitize user-provided arguments before execution. The use of `StrictHostKeyChecking=no` also weakens SSH security.