allstock-data

• Analyzed: May 14, 2026, 4:36 AM
• Findings: 1
• Version: 1.0.2
• Hash: 040ab4b9236ac533238a78f3e59efaac5245c090492e2b6f5639983ea34efa8b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file demonstrates the use of `curl` commands and `pip install` instructions, which, if executed by the AI agent with unsanitized user input, could lead to shell injection vulnerabilities. Specifically, user-controlled parameters like `stock_code` in `curl` commands or `ip` in `adata.proxy` could be exploited. While these capabilities are plausible for the skill's stated purpose of fetching stock data, the lack of explicit input sanitization guidance for the agent creates a significant risk of command injection or arbitrary network redirection, classifying it as suspicious rather than benign due to the potential for exploitation.