Niche Calendar

• Analyzed: May 11, 2026, 1:07 AM
• Findings: 1
• Version: 1.0.0
• Hash: 10fe60082650362622e7ec90ee4eb050fe5db9463eb423613c8cb80ad2164e46
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructions in SKILL.md direct the AI agent to use the 'exec' tool to run shell commands (e.g., 'clawhub search {term}') using parameters derived directly from user queries. This pattern introduces a potential shell injection vulnerability if the input is not properly sanitized before execution. While the functionality appears aligned with the stated purpose of tracking developer releases and sports schedules, the reliance on unvalidated shell execution is a high-risk security flaw.