Ai Social Media Content

• Analyzed: May 12, 2026, 3:31 AM
• Findings: 1
• Version: 0.1.5
• Hash: 2e57a40d5fa728cf7ef79e428be669086735a8138e93a539751b8d8132fce937
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file contains instructions for installing the `inference.sh` CLI via `curl -fsSL https://cli.inference.sh | sh` and for adding related skills via `npx skills add ...`. These commands do not adhere to the `allowed-tools: Bash(infsh *)` directive specified for the AI agent. This creates a prompt injection vulnerability, as an attacker could potentially instruct the agent to execute these out-of-scope commands, bypassing the intended sandbox. Additionally, the skill includes a `twitter/post-tweet` command, which, while a stated feature, represents a high-impact capability that could be abused if the agent is compromised.