aiinsight-daily-new

• Analyzed: May 11, 2026, 7:25 AM
• Findings: 1
• Version: 1.0.0
• Hash: 72f664d31843254d94da736d698c3da90c70ed73fe041332b418207c0efdf472
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a critical code injection vulnerability in `scripts/fetch.sh` where shell variables (`$RSS_URL` and `$COUNT`) are directly expanded into a Python heredoc. This allows for arbitrary Python code execution if these environment variables are influenced by an attacker or a malicious prompt. While the stated purpose of fetching AI news from a legitimate RSS source appears benign and there is no evidence of hardcoded data exfiltration, the insecure implementation poses a significant security risk.