Addis Assistant

• Analyzed: May 12, 2026, 3:14 AM
• Findings: 1
• Version: 1.0.0
• Hash: c1faab98f2eda930491335b98862791210e99b34cc998d80fc3eab99a34c8f6a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for Speech-to-Text and text translation using the Addis Assistant API. The `SKILL.md` provides clear instructions without any prompt injection attempts. The Python scripts (`stt.py`, `translate.py`) use `subprocess.run` to execute `curl` commands, sending an API key and user-provided data (audio file path or text) to `api.addisassistant.com`. This behavior is directly aligned with the stated purpose of interacting with an external API and does not show evidence of intentional malicious activity such as data exfiltration beyond the API interaction, persistence, or unauthorized command execution. The use of `curl` with arguments passed as a list mitigates common shell injection risks.