Daxiang Dogfood

• Analyzed: Mar 31, 2026, 6:01 PM
• Findings: 1
• Version: 1.0.0
• Hash: 2391eb65c7a3e2c7953642e6331dde2724ffea96342e2bfe446f954e9e9bb8d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for exploratory web testing but contains potential shell injection vulnerabilities in SKILL.md. Specifically, variables like {OUTPUT_DIR} and {TARGET_URL} are used in shell commands without consistent quoting (e.g., in 'mkdir' and 'agent-browser' calls), which could allow for arbitrary command execution if provided with malicious input. Additionally, the skill saves sensitive authentication states to the local file system (auth-state.json), which is a common but risky practice in browser automation.