Nova Accountability

• Analyzed: Apr 22, 2026, 12:16 PM
• Findings: 1
• Version: 2.0.0
• Hash: 372d5427f252ccc3bc31a1c47c474e37d77733f4f37051c0bb7a18ccef383346
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains shell injection vulnerabilities in `scripts/monday-api.sh` due to unsafe handling of arguments in the `query` function and `update` command. Additionally, the `SKILL.md` instructions contain high-risk directives for an autonomous agent, such as 'Don't limit yourself' when messaging people and spawning sub-agents, which could lead to unauthorized communications or resource exhaustion. While the behavior aligns with the stated purpose of a proactive 'Accountability' manager, the combination of insecure scripting and broad operational autonomy warrants a suspicious classification.