Kanban Workflow

• Analyzed: May 11, 2026, 4:50 AM
• Findings: 1
• Version: 0.1.12
• Hash: e226390f17ce4414b0e1eeda38eccfd78e8c2baf9b0e591945ec925f83bfa890
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to potential shell injection vulnerabilities. User-controlled input (e.g., `--title`, `--body`, `--text` from `src/cli.ts`) is passed as arguments to external CLI commands (e.g., `gh`, `plane`) via `execa` in adapter files like `src/adapters/github.ts` and `src/adapters/plane.ts`. While `execa` mitigates basic shell injection by separating command and arguments, if the underlying external CLIs do not properly sanitize or quote these arguments, a crafted input could lead to arbitrary command execution. There is no evidence of intentional malicious behavior like data exfiltration or backdoors, and the documentation (`SKILL.md`, `README.md`) is benign.