Knowledge Harvester

• Analyzed: May 14, 2026, 7:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 031e5b6155984e8f3d278e5c47d88f5bb9595ee380079c36b470f153395d54a7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The Knowledge Harvester bundle automates news retrieval and summarization but is classified as suspicious due to high-risk behaviors and potential vulnerabilities. The instructions in SKILL.md direct the AI agent to execute shell commands using unvalidated strings (e.g., article titles and domain queries), creating a risk of command injection. Additionally, the bundle requires network access via curl in scripts/fetch-articles.sh to reach news.google.com and performs broad file system operations. While these actions are consistent with the stated purpose, the lack of input sanitization and the use of shell-based processing of external data constitute significant security risks.