Hacker News
PassAudited by VirusTotal on May 12, 2026.
Findings (1)
The skill is classified as suspicious due to the presence of shell command substitutions (e.g., `$(date -d '24 hours ago' +%s)`) within `curl` examples in `search.md`. While the `date` command itself is benign and used for a legitimate purpose (generating timestamps for API queries), its inclusion in markdown documentation presents a potential shell injection vulnerability if the AI agent's execution model directly interprets and executes such examples in a shell environment. This constitutes a 'risky capability' without clear malicious intent, aligning with the definition of suspicious behavior.