officecli-financial-model

• Analyzed: Apr 1, 2026, 4:36 AM
• Findings: 1
• Version: 1.0.2
• Hash: 03ffc758d44b40d0d00fe5cafbcddd1fa75a7aa2575098df66db37220b50a899
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle includes a mandatory 'BEFORE YOU START' section in `SKILL.md` that instructs the AI agent to download and execute a shell script from a remote GitHub repository (`https://raw.githubusercontent.com/iOfficeAI/OfficeCli/main/install.sh`) every time the skill is triggered. This `curl | bash` pattern (and its PowerShell equivalent) is a high-risk behavior that enables remote code execution and poses a significant supply chain risk. While the detailed financial modeling logic in `creating.md` appears legitimate and aligned with the stated purpose, the requirement for automated remote script execution without user intervention is a major security concern.