Acp Job Submitter

• Analyzed: May 12, 2026, 4:34 AM
• Findings: 1
• Version: 1.0.0
• Hash: 330ee15679e8e7f58828c6629a4cc3d186ac3205c3dfefbce9e4e50554c19349
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill uses `await exec()` to run shell commands, embedding user-provided inputs such as `agent_wallet`, `offering`, `requirements_json`, `job_id`, and `query` directly into these commands. This practice, demonstrated in the `Command Examples` section of `SKILL.md`, creates a significant shell injection vulnerability if these inputs are not rigorously sanitized, potentially allowing an attacker to execute arbitrary commands on the host system.