Security Sentinel Ultimate

• Analyzed: May 10, 2026, 6:31 AM
• Findings: 1
• Version: 0.3.0
• Hash: 17f6fc325e41a6d841d63e559f5e6d95961d17b13da99fa57b74b4f048f90f55
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a security scanner that uses Python's AST module in `scanner.py` to detect dangerous coding patterns, hardcoded secrets, and obfuscation techniques. While the code logic is well-implemented and aligned with its stated purpose, the skill is classified as suspicious due to a critical shell injection vulnerability in `SKILL.md`. The `scan_skill` tool passes the user-provided `path` argument directly into a shell command (`python3 ... "{{path}}"`) without sanitization, which could allow an attacker to execute arbitrary commands by including shell metacharacters (e.g., quotes and semicolons) in the path.