Mixlab Fill Content

• Analyzed: May 14, 2026, 4:14 AM
• Findings: 1
• Version: 1.1.3
• Hash: 0a81578b5c957bdc173b5b37cea0aa3b12391ecc137ef137422eadca547387c4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a critical vulnerability in `scripts/02-fetch-content.js`. This script uses `child_process.spawn` to execute `curl` with a URL (`url`) obtained from an external API (`mixdao.world`). The `url` is not sanitized, making the skill vulnerable to Server-Side Request Forgery (SSRF) and local file disclosure. If a malicious URL (e.g., `file:///etc/passwd` or one containing `curl` command-line options like `--output`) is provided by the external API, `curl` could be coerced into disclosing local files or performing unintended network requests. While there is no clear evidence of intentional malicious behavior by the skill's author, this lack of input sanitization for an external command constitutes a significant security risk.