officecli-pitch-deck

• Analyzed: May 10, 2026, 6:36 PM
• Findings: 1
• Version: 1.0.2
• Hash: 299a3da566ff35170c9bcba4f0ae4bfafe2a8809a55dc7f27331bde5320ab258
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md file contains instructions for the AI agent to perform a 'curl | bash' operation to install or upgrade a dependency (officecli) from a remote GitHub URL (raw.githubusercontent.com/iOfficeAI/OfficeCli/main/install.sh). While this behavior is plausibly intended for setup, executing unverified remote scripts is a high-risk pattern that could be leveraged for arbitrary code execution or supply chain attacks. No other malicious indicators like data exfiltration or obfuscation were found.