Invoice

• Analyzed: May 12, 2026, 3:59 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3380cfdd300819b2ed2fd184a6348c22ec58ca50b21119eb319d52f5cd699654
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for invoicing, which involves handling sensitive business data and performing file system operations, email sending, and PDF generation. It is classified as 'suspicious' due to significant vulnerabilities, primarily the explicit instruction to use `weasyprint invoice.html invoice.pdf` for PDF generation in `templates.md` and `phases.md`. This presents a clear shell injection risk if the `invoice.html` path or its content (which is dynamically generated from various data, including user input) is not rigorously sanitized. Additionally, the HTML template in `templates.md` uses placeholders that, if not properly HTML-escaped, could lead to cross-site scripting (XSS) or HTML injection in the generated invoice, which could then be exploited during PDF rendering. While there is no evidence of intentional malicious behavior (e.g., data exfiltration or backdoors), these vulnerabilities could be exploited by a malicious user to achieve remote code execution or other harmful actions.