URL to PNG

• Analyzed: May 12, 2026, 3:49 AM
• Findings: 1
• Version: 0.0.2
• Hash: 231cd4632f267324d06cf7c630a8743f75504ed11527862ca4419bdbc02c8882
• Source: palm
• External report: View on VirusTotal

Findings (1)

The 'url2png' skill's primary function is benign, converting URLs to PNGs using legitimate tools like `shot-scraper`. However, the `url2png.sh` script is vulnerable to shell injection. The `outdir` variable, which can be controlled by user input, is directly used in `mkdir -p ${outdir}` and `cd ${outdir}` commands without proper sanitization. This allows an attacker to execute arbitrary commands by providing a specially crafted output directory path, posing a significant remote code execution risk. This is a critical vulnerability, but not evidence of intentional malicious design.