Lyric Flip

• Analyzed: May 11, 2026, 6:34 AM
• Findings: 1
• Version: 1.0.0
• Hash: 91fec1cdace45b6f6d7535a1632bc19c6dcdefa2bc8ecbf46a0adb429ade588d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill (SKILL.md) facilitates lyric and song generation via the SenseAudio API (api.senseaudio.cn) but contains a significant shell injection vulnerability. The instructions direct the agent to construct curl commands by directly embedding user-controlled input (lyrics and themes) into the command string, which could allow for arbitrary command execution on the host. While the functionality aligns with the stated purpose and lacks clear evidence of malicious intent, the high-risk nature of this implementation flaw warrants a suspicious classification.