Film Production Assistant

• Analyzed: Apr 3, 2026, 4:36 AM
• Findings: 1
• Version: 1.0.1
• Hash: d39bf38e5597691d5815430084f6fb5e412cf628155bde39a8685a4142fa5bc8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The film-production-assistant skill bundle provides a professional set of templates for film pre-production. However, the SKILL.md file contains a bash command template for exporting documents via pandoc that is vulnerable to shell injection. It directly incorporates unsanitized user-controlled variables, such as {{user-specified-path}} and {{ProjectTitle}}, into a command-line string. While the functionality is consistent with the stated purpose of the skill and no malicious intent is evident, the inclusion of an unsafe execution pattern that could lead to Remote Code Execution (RCE) warrants a suspicious classification.