科技投资日报

• Analyzed: May 11, 2026, 4:56 AM
• Findings: 1
• Version: 1.1.0
• Hash: 6c4e0e5e0d0c30da38ca1bf0ab1417bf3d7321ece71c13ff97c4ed789dc679a8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to critical prompt injection vulnerabilities in `SKILL.md`. The AI agent is instructed to execute shell commands (`python3` and `bash`) where arguments (such as stock codes for `scripts/report.py` and file paths for the `md2pdf-weasyprint` script) are constructed by the agent. If an attacker can craft a prompt that causes the agent to include shell metacharacters (e.g., `;`, `$()`) in these arguments, it could lead to arbitrary command execution (shell injection).