Ravenclaw - Email Bridge

• Analyzed: May 14, 2026, 4:10 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5f1f66aa3efe8775217cccd1f0b4308087eedf07211b96d7c732eaf92f448d4b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `ops.sh` script contains a shell injection vulnerability. User-controlled input (e.g., email body, subject) is directly interpolated into a JSON string passed as the `-d` argument to `curl`, without proper sanitization. This could allow an attacker to inject arbitrary shell commands if `ops.sh` is executed with untrusted input, potentially leading to remote code execution. There is no evidence of intentional malicious behavior such as data exfiltration, persistence, or prompt injection attempts against the agent in the markdown files.