GitHub Extract

• Analyzed: May 12, 2026, 3:56 AM
• Findings: 1
• Version: 0.0.2
• Hash: db8bb94d6a99295d5b6a519d388296102d06dcea2bb7b58a90f112f223befcff
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to the direct execution of `wget` with a user-provided URL in `gh_extract.py`. The `SKILL.md` instructs the AI agent to pass user input directly as the `<url>` argument to the Python script, which then uses `subprocess.run(['wget', ..., url])`. While `subprocess.run` with a list mitigates direct shell injection, it exposes the `wget` command to potential vulnerabilities if a crafted URL can exploit `wget` itself (e.g., arbitrary file writes or SSRF), representing a lack of robust input sanitization for external command execution.