Fía Signals

• Analyzed: May 11, 2026, 4:51 AM
• Findings: 1
• Version: 2.1.0
• Hash: 9836df05c3c66d4861cc0ea3f1da902c3fb70792852e00449c83543d0954bff8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/fia_signals.sh` file contains a critical shell injection vulnerability. User-supplied arguments (e.g., `CHAIN`, `SYM`, `ADDR`) are directly interpolated into the `curl` command string without proper sanitization or quoting. This allows an attacker to inject arbitrary shell commands by crafting specific input, leading to potential Remote Code Execution (RCE) on the agent's system. For example, `fia_signals.sh dd 'BTC; malicious_command'` would execute `malicious_command`. While this is a severe flaw, there is no clear evidence of intentional malicious behavior (e.g., data exfiltration, persistence, or unauthorized remote control) designed by the skill's author, thus classifying it as suspicious rather than malicious.