Process Flow Navigator

• Analyzed: May 17, 2026, 6:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0979c6acd0b1d98582d50c1a186d14d405b577df9b2e223f0afcc7809ffba245
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a command injection vulnerability in `scripts/navigate.sh`. The `get_node_code` function interpolates the `$node` shell variable directly into a `python3 -c` command string without sanitization, which could allow an attacker to execute arbitrary Python code. While the logic in `SKILL.md`, `README.md`, and `data/flow-rules.json` appears aligned with the stated purpose of business process navigation, the presence of this high-risk vulnerability requires a suspicious classification.