AICash Miner

• Analyzed: May 11, 2026, 4:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: e13c987eddf668d156258aa9321a7bc460d2ce1a24523caf24336666a6a5eff5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to critical shell injection and arbitrary file write vulnerabilities in `scripts/setup.sh`. User-provided arguments such as `--api-key`, `--wallet`, `--endpoint`, and especially `--name` are used directly in `sed` commands and systemd service file creation without proper sanitization. This allows for remote code execution or arbitrary file writes (e.g., to `/etc/systemd/system/`) if crafted inputs containing shell metacharacters or path traversal sequences are provided. The `scripts/start.sh`, `scripts/status.sh`, and `scripts/stop.sh` scripts are also vulnerable to command injection if a maliciously named service was previously created via `setup.sh`.