Team Outing Planner

• Analyzed: Apr 1, 2026, 1:27 PM
• Findings: 1
• Version: 1.0.1
• Hash: c50571888c31c544694bc9f55860113147ec8a3d73dc4deed13e4dc8045680f8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides legitimate team outing planning functionality but exhibits risky behaviors by instructing the AI agent to execute shell commands (`flyai-cli` and `open`) and perform file system operations in the user's home directory (`~/team-outing-recommendation.html`). Specifically, the instructions in `SKILL.md` direct the agent to construct shell commands using potentially unsanitized user input (e.g., city names or destination keywords), which presents a shell injection vulnerability. While the intent appears benign and aligned with the stated purpose, the lack of input validation and the use of broad shell execution capabilities meet the criteria for a suspicious classification.