Generate Presentation

• Analyzed: May 15, 2026, 4:09 AM
• Findings: 1
• Version: 1.0.0
• Hash: bbd89a76a5cdd47b2aeb10d7c91d36d2c1ddad3dee6a9e31cbd588fb44e22739
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several high-risk capabilities and potential vulnerabilities. The `.claude/settings.local.json` grants `Bash(rsync:*)` permission, allowing the agent to execute arbitrary `rsync` commands, which could be exploited for data exfiltration. Additionally, the `edit-image` tool within `mcp-servers/openai-gpt-image/src/index.ts` accepts absolute file paths for its `image` and `mask` inputs, creating a local file disclosure vulnerability if an attacker can control these paths via prompt injection. While the skill's `SKILL.md` does not explicitly instruct the agent to perform malicious actions, these permissions and tool capabilities present significant attack surfaces.