Git Manager

• Analyzed: May 10, 2026, 6:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8f1374f6e65af0c5977158e0f0753c069ab0c70e28341cc664970b740be1e878
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a critical shell injection vulnerability in `index.ts` where unsanitized user inputs (such as `message` and `repo`) are concatenated into a command string executed via `child_process.exec`. Additionally, `index.ts` relies on a hardcoded absolute path to a specific user's directory (`/Users/nico/...`), which is highly irregular for a portable skill bundle and suggests either environment-specific configuration or potential tampering. There is also a discrepancy between the main entry point defined in `skill.json` and the script actually invoked in the code.