Marktplaats

• Analyzed: May 14, 2026, 3:00 AM
• Findings: 1
• Version: 0.3.0
• Hash: eb5919cd5f1ba277a732e24c86f23ea6c9fbf85a935a0089e4ed8b1ea5f01e4e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the `getListingDetails` function in `src/api.js`. This function accepts a `urlOrPath` parameter and will fetch any `http` or `https` URL if the input starts with either protocol. While intended for Marktplaats listing details, this broad network access could be exploited for Server-Side Request Forgery (SSRF) to probe internal networks or access unauthorized external resources if an attacker can control the input (e.g., via prompt injection against the agent or crafted CLI arguments). There is no explicit malicious intent like data exfiltration or remote code execution, but the capability to make arbitrary outbound requests is a significant risk.