Nyne Deep Research

• Analyzed: May 12, 2026, 4:25 AM
• Findings: 1
• Version: 1.0.0
• Hash: d461d21c540fca6f619c83b22bf9972512e907981b861763c956e3c4b488095e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a significant shell injection vulnerability present in the `SKILL.md` examples. The `curl -d` commands construct JSON payloads by directly concatenating strings, which, if user input for parameters like `email`, `phone`, `social_media_url`, `name`, `company`, `city`, or `callback_url` is not properly sanitized by the agent, could allow arbitrary command execution. Additionally, the `callback_url` parameter, while not explicitly used in the provided examples, represents a potential data exfiltration channel if an agent were prompted to use it with an attacker-controlled URL, allowing the sensitive dossier data to be sent to an unauthorized endpoint by the Nyne API service.