Exchange Rates

• Analyzed: May 14, 2026, 3:12 AM
• Findings: 1
• Version: 1.0.1
• Hash: cc7e5b9753ea2a4c8e55676a5ac96aa01fcc4d6d9ab436d7c5ea9693a7ce8915
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a hardcoded CDP token (`ec546a08aed110e96f64cc645bdb58fa8829a63349d6ae53`) in `scripts/xe-rate.mjs` which is a security weakness. Additionally, the `scripts/xe-rate.mjs` script directly uses `process.argv` inputs (currency codes, amount) without explicit sanitization, which, depending on the agent's command execution mechanism, could lead to shell injection vulnerabilities. These are significant security flaws, but there is no clear evidence of intentional malicious behavior like data exfiltration or backdoor installation.