Skill Scaffold

• Analyzed: May 12, 2026, 3:18 AM
• Findings: 1
• Version: 1.0.4
• Hash: f1a535908f419a1d292da4676db37ad8cc3c9cc023cb51337a99d51649bc4a9e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `bin/skill-scaffold.js` script, which generates skill files, does not sanitize user-provided `description` and `author` inputs before embedding them into the generated `SKILL.md` and `README.md`. This lack of input sanitization creates a vulnerability where a malicious `description` could be crafted to perform prompt injection against an AI agent that subsequently reads the generated `SKILL.md`. While the tool itself does not exhibit malicious behavior, it facilitates the creation of vulnerable content, classifying it as suspicious due to this potential for downstream exploitation.