SEC Filings

• Analyzed: May 14, 2026, 1:01 PM
• Findings: 1
• Version: 1.0.0-beta.1
• Hash: a041261da7bdb8ae316a7d007fe99415df5b4b00c22977dc4447a5d3b3b78eb4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates SEC filing searches by instructing the agent to use `curl` to access a third-party API (`labs.lovelace.ai`) in `SKILL.md`, which involves shell-based network access and potential shell injection vulnerabilities if parameters are not sanitized. While the functionality is aligned with the stated purpose, the use of an external intermediary and the presence of an anomalous future-dated timestamp (2026) in `_meta.json` are flagged as risky indicators under the provided guidelines.