Freelancer Toolkit

• Analyzed: Mar 31, 2026, 9:41 PM
• Findings: 1
• Version: 1.0.3
• Hash: a6a6a0710b9937db7db806a5a210a1d0153290a4335effe958e467db5a933c92
• Source: palm
• External report: View on VirusTotal

Findings (1)

The Freelancer Toolkit is a comprehensive skill bundle for time tracking and project management, but it contains path traversal vulnerabilities in its reporting and export logic. Specifically, the script `scripts/client-report.sh` and the instructions in `SKILL.md` use unsanitized client names to construct file paths for writing reports and invoices (e.g., `client-report-${SAFE_NAME}.md`). This lack of input sanitization could allow for arbitrary file overwrites if a malicious client name is introduced into the local database, potentially via indirect prompt injection. While the bundle is well-documented and lacks evidence of intentional malice or data exfiltration, these security flaws pose a risk to the host system.