Tutor Buddy Pro

• Analyzed: May 10, 2026, 6:28 AM
• Findings: 1
• Version: 1.0.3
• Hash: 018ed1e819b8ca4d3538cee46e33a66f3cdc1fdab938045be2e0761c2920401e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides an AI tutoring platform with a report generation feature. The script `scripts/generate-progress-report.sh` is classified as suspicious because it introduces high-risk capabilities, specifically the use of a headless browser (Playwright) and shell execution to render HTML reports. The script also contains vulnerabilities, such as the potential for arbitrary file writes via an unvalidated output path argument and a lack of HTML escaping for user-provided data (e.g., student names) in the generated report, which could lead to local code execution within the browser environment. While these features are aligned with the stated purpose of visual progress tracking, the implementation provides a significant attack surface without sufficient sanitization.