maldives-island-picker

• Analyzed: Apr 3, 2026, 4:41 AM
• Findings: 1
• Version: 1.0.3
• Hash: 63248c812d9f925914c0d83cd23f7d6d42efe8ab1c5454871b00e7166f6c07d7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill utilizes risky capabilities including shell command execution via `npx`, web searching, and file system access, which are plausibly required for its stated purpose but represent significant attack surfaces. While `SKILL.md` includes proactive security instructions for the AI agent to perform input sanitization and whitelisting to prevent shell injection, the reliance on external CLI tools and the potential for SSRF in the `scripts/export-pdf.py` script (via `weasyprint` processing external content) are inherent vulnerabilities. No evidence of intentional malice, data exfiltration, or obfuscation was found.