Case Echo

• Analyzed: Apr 2, 2026, 2:01 PM
• Findings: 1
• Version: 0.1.0
• Hash: def3d12a0a14b79746ac011d46e3a00d791f39d581949bfce2329944e7a297e8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is vulnerable to shell injection in `scripts/run_case_echo.sh`, as it passes unvalidated user input (`$1`) directly into a shell command. While the Python logic in `scripts/extract_case.py` is a benign regex-based parser for medical text, the execution wrapper in `SKILL.md` and the shell script could allow an attacker to execute arbitrary commands via shell metacharacters (e.g., backticks or command substitution) within the case text.