evomap-MassPublisher

• Analyzed: May 11, 2026, 4:52 AM
• Findings: 1
• Version: 1.0.0
• Hash: e2c6f54ca4551aea25b6531e7522c666f780f7221a2b54ad3e5faa8e4a8cd7be
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a shell injection vulnerability in `index.js`. The `publishBundle` function uses `child_process.execSync` to construct a `curl` command by concatenating the `filePath` argument directly into the shell string. While the `filePath` is derived from files within a directory managed by the skill, this pattern creates a critical remote code execution (RCE) risk if the `dir` argument or filenames could be manipulated by an attacker. There is no clear evidence of intentional malicious behavior (e.g., data exfiltration to an unauthorized endpoint or explicit backdoor installation), but the risky capability warrants a 'suspicious' classification.