Dub.co Links API

• Analyzed: May 12, 2026, 4:19 AM
• Findings: 1
• Version: 1.0.1
• Hash: cda39afab4dac47e2393a8e28ea2f1a04e50d075c1530e55e96c3ace5b337149
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to interact with the Dub Links API using `curl` commands, as demonstrated in `SKILL.md`. While the examples themselves are benign and the skill explicitly defines 'Out of Scope' actions, the instruction for the AI agent to construct and execute `curl` commands based on user input introduces a shell injection vulnerability. If the agent fails to properly sanitize user-provided data before interpolating it into the `curl` command's URL, headers, or body, it could lead to arbitrary command execution. This is a vulnerability (RCE risk) rather than intentional malice, classifying it as suspicious.