Comind

• Analyzed: May 11, 2026, 4:43 AM
• Findings: 1
• Version: 2.3.4
• Hash: 70d4202f742deb16e32093c31900470fc2cf8714da82ce5ea1bb35b56e0472f7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains critical vulnerabilities that could be exploited via prompt injection against the AI agent. Specifically, the `mcp_call` function in `SKILL.md` is vulnerable to shell injection due to unsanitized string concatenation when constructing `curl` commands, allowing arbitrary command execution. Additionally, the `scripts/render-template.py` script is vulnerable to path traversal when reading template files, potentially allowing an attacker to read arbitrary files. There is also a potential privilege escalation risk with the `get_mcp_token` action if the `member_id` parameter can be controlled by the agent through a malicious prompt.