Mufi Calendar

• Analyzed: May 12, 2026, 4:10 AM
• Findings: 1
• Version: 1.0.0
• Hash: 1f68f1bf77faed7316da0d4c374684092afb64c63b24f640f65cde0954b614c8
• Source: palm
• External report: View on VirusTotal

Findings (1)

```json { "classification": "suspicious", "summary": "The skill is suspicious due to a potential shell injection vulnerability in `scripts/remind.js`. The `execSync` call constructs a command to send a Discord message, incorporating event summaries from Google Calendar. While an attempt is made to escape double quotes (`.replace(/\"/g, '\\"')`), other shell metacharacters (e.g., backticks, semicolons, dollar signs) are not escaped, potentially allowing an attacker who can control Google Calendar event summaries to execute arbitrary commands on the host system. This is a vulnerability, not malicious intent, as the primary purpose is legitimate inter-skill communication." } ```