Elasticsearch

• Analyzed: May 12, 2026, 4:25 AM
• Findings: 1
• Version: 0.1.0
• Hash: 2f269c4431df9e4b6ab678f6cff143bacbfa9a2838343b6665e92cd3a10e34c2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides comprehensive instructions for interacting with Elasticsearch and Kibana via `curl`. It is classified as suspicious due to a potential shell injection vulnerability: `SKILL.md` instructs the AI agent to `export` user-provided `ES_URL` and `ES_API_KEY`. If the agent does not sanitize these inputs before executing the `export` command, an attacker could inject arbitrary shell commands. While the skill's `curl` commands use `$(printenv ES_API_KEY)` for safer expansion, the initial `export` instruction itself is vulnerable. All network calls are directed to the user-defined Elasticsearch/Kibana URLs, and there is no evidence of intentional data exfiltration or persistence mechanisms within the skill's logic.