AnyLink to Note

• Analyzed: Apr 18, 2026, 10:46 AM
• Findings: 1
• Version: 1.0.1
• Hash: 26096071e3c7d178a3cbe256cf916d93b3e38d901f7e26e550093ebd149431e5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a significant shell injection vulnerability in the RSS extraction logic described in SKILL.md and references/url-types.md. The instructions direct the agent to execute a shell command (`curl -sL "<rss-url>" | python3 ...`) using a user-provided URL without sanitization, which could lead to arbitrary command execution. While the intent appears to be legitimate web scraping and note-taking, the implementation of the RSS and Playwright-based extraction methods poses a security risk.