Intel Synthesis

• Analyzed: May 12, 2026, 4:14 AM
• Findings: 1
• Version: 1.0.0
• Hash: 97f468e76561ad801bae20fb696b5e239b124665d24da7c275765d3b56e9dc31
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to perform direct command execution using external binaries like `xelatex` and `pandoc` via hardcoded paths (`/Library/TeX/texbin/`) in `SKILL.md`. This presents a significant shell injection vulnerability if the input arguments to these commands are not properly sanitized by the OpenClaw runtime. Additionally, the skill instructs the agent to send emails to external recipients, which is an outbound communication channel, and accesses specific user directories (`/Users/mikethebrain/.openclaw/workspace/sf.tex`) and mounted volumes (`/Volumes/Intel/NewsBriefs/`). These capabilities, while potentially aligned with the stated purpose, introduce high-risk behaviors that could be exploited.