Gemini Ops

• Analyzed: May 11, 2026, 4:46 AM
• Findings: 1
• Version: 1.0.0
• Hash: bdc32e84e09d5d115d4059776af73eb876cfe5cf4bc6ea367c8c640390583795
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to a critical path hijacking vulnerability. Its core functionalities, including 'Turn Gemini ON', 'Turn Gemini OFF', and 'Check status', are not implemented within the bundled scripts. Instead, `scripts/gemini-on.sh`, `scripts/gemini-off.sh`, and `scripts/gemini-status.sh` immediately call external scripts located at fixed, absolute paths (e.g., `/home/moltuser/clawd/scripts/gemini-on.sh`). This design makes the skill's behavior dependent on unbundled, unverified external code, creating a severe vulnerability where an attacker controlling those external paths could achieve arbitrary code execution.