kosmi dj

• Analyzed: May 12, 2026, 4:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: dba494eafaa44428452315f7bf2a21b48c7c0a453f3c5d918268ba752fad6d37
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its reliance on external, potentially untrusted input for critical operations. It processes URLs (`KOSMI_ROOM_URL`, `VIDEO_URL`) from environment variables loaded from a `.env` file or a FIFO/playlist, which are then opened or filled into the `agent-browser`. A malicious URL could lead to browser-based exploits or phishing if the `agent-browser` or the target application (Kosmi) has vulnerabilities. Additionally, sensitive credentials (`KOSMI_EMAIL`, `KOSMI_PASSWORD`) are loaded from the `.env` file, making the skill's security dependent on the integrity of this external configuration. The `kosmi-loop.sh` script also manages its process using a PID file in `/tmp/kosmi-dj-loop.pid`, a common pattern that can sometimes introduce minor local vulnerabilities if the PID file is tampered with. These issues are primarily input validation and configuration risks, not direct evidence of intentional malicious behavior.