Gene Engine

• Analyzed: May 9, 2026, 12:26 PM
• Findings: 1
• Version: 1.0.1
• Hash: 00e3f9e05b388f70d27e49f9d9f4345ccb87301f4c8d51014d869c72c7265fc1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a 'Gene Engine' for managing agent behavior rules, but contains significant security vulnerabilities in its shell scripts. Specifically, `gene-engine.sh` and `gene-trigger.sh` use `python3 -c` to manipulate JSON data by directly interpolating shell variables into Python code strings (e.g., using `'''$OUTCOME'''`). This pattern is highly susceptible to Python/command injection if the inputs (like the outcome description) contain malicious payloads. While the logic appears aligned with the stated purpose of agent lifecycle management and lacks evidence of intentional malice or exfiltration, the high-risk implementation of data handling warrants a suspicious classification.