prompt-engineer

• Analyzed: May 6, 2026, 11:26 AM
• Findings: 1
• Version: 1.0.0
• Hash: 53085342fa1e520bbf495e08e750bc4601f69fe147ea9ee2f00a94cf8dc1b3ba
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a high-risk code execution vulnerability in 'references/examples.md'. Specifically, the 'create_custom_agent' function implements a 'Calculator' tool using Python's 'eval()' function on unsanitized input, which allows for arbitrary code execution (RCE). While this appears to be an unintentional insecure coding pattern common in LLM framework examples rather than intentional malware, it represents a significant security flaw.