Teambition

• Analyzed: Mar 31, 2026, 1:01 PM
• Findings: 1
• Version: 1.0.0
• Hash: ef51d5a880212f6790cc9a7764df496c6f142b7b75e4e2ae7832e859eb97d0b6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill manages Teambition integration via an MCP server and uses shell commands (echo, grep, cut) in SKILL.md to read and write configuration data and user IDs to local files. These instructions lack input sanitization, creating a potential shell injection vulnerability if the agent handles malicious user-provided URLs or IDs. Additionally, the skill requires 'npx' and manages authentication tokens in local files, which are high-risk capabilities that, while plausible for the stated purpose, require careful handling to prevent exploitation.