Healthcheck Litiao

• Analyzed: May 11, 2026, 7:05 AM
• Findings: 1
• Version: 1.0.0
• Hash: 72f3d404123476bfd07a04d1f22045affb24f482653b8b856fe57a674975012e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle uses 'node -e' to execute logic via shell commands in SKILL.md, relying on the AI agent to perform string replacement (e.g., CUPS, NEW_CUPS) with user input. This pattern introduces a significant code injection vulnerability, as a malicious user could provide input that escapes the intended logic to execute arbitrary Node.js code. While the functionality aligns with the stated health-tracking purpose and lacks evidence of intentional malice or exfiltration, the insecure implementation poses a high risk.