Fork-It

• Analyzed: May 14, 2026, 10:21 AM
• Findings: 1
• Version: 2.0.2
• Hash: 7751972949dece2918bdde3bd8f309039e8b87669a529d1d56b37f68335d7c56
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill 'fork-it' contains significant shell injection vulnerabilities in its core scripts. Both scripts/github-search.mjs and scripts/repo-detail.mjs use child_process.execSync to execute curl commands, incorporating command-line arguments (like repository names or search parameters) directly into the shell string without sufficient sanitization or escaping. While the tool's logic is aligned with its stated purpose of searching GitHub, the insecure implementation allows for potential arbitrary command execution if the agent is manipulated into passing malicious strings as arguments.