market_test_price

• Analyzed: May 12, 2026, 4:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 85d4e1cd73dd159fcd3dd61831889f1f6973305a7b0b1d38831fada14a95fe70
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to requesting overly broad permissions for its stated purpose. The `SKILL.md` file lists `bash_tool` and `create_file` in `allowed_tools`. While the core Python script `scripts/market_test_price.py` does not directly utilize these high-privilege tools (it uses standard Python libraries for HTTP requests), granting an AI agent arbitrary shell execution (`bash_tool`) and file creation (`create_file`) capabilities for a simple 'fetch token prices' skill introduces a significant attack surface for prompt injection or agent misuse, potentially leading to remote code execution or unauthorized file system modifications.