A nach B - AT Public Transport Service (VOR)

• Analyzed: May 13, 2026, 3:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9866f3f6eb65a1e71dbde7c0ad1f3ae52376bd46897096e68bd2cd9b53ee7043
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a JSON injection vulnerability present in all shell scripts (`departures.sh`, `disruptions.sh`, `route.sh`, `search.sh`). User-provided arguments are directly embedded into the JSON payload without proper escaping, allowing a malicious user to inject arbitrary JSON fragments into the API request. While this does not lead to arbitrary shell command execution on the agent's host, it could enable malformed API requests to the `https://vao.demo.hafas.de/gate` endpoint, potentially causing unexpected behavior or errors on the API side. No other malicious indicators such as data exfiltration, persistence, or prompt injection against the agent were found.