Ouraskill

• Analyzed: May 12, 2026, 3:39 AM
• Findings: 1
• Version: 1.0.3
• Hash: fa187abae58480a56eac1356871906f6400f828193fc201b84ef8d9bad015818
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a path traversal vulnerability in `scripts/sync_oura.py`. The `--output-dir` argument, if manipulated by a malicious prompt to the AI agent, could allow writing markdown files to arbitrary locations on the filesystem (e.g., `/etc/passwd` or `/tmp/sensitive_data`). While the content written is benign markdown (Oura health data) and not arbitrary code, this vulnerability could lead to data corruption or denial of service if critical system files are overwritten. There is no evidence of intentional malicious behavior or data exfiltration beyond the stated purpose.