sys-updater

• Analyzed: May 12, 2026, 3:38 AM
• Findings: 1
• Version: 1.1.0
• Hash: ce8efe5c9ed727d435308ffc1e3996a5aad82399289da07dc9033c41e8d6ce2f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill's stated purpose is system maintenance, including security updates and package management. However, the `scripts/apt_maint.py` file attempts to execute `sudo apt-get install -y` and `sudo apt-get autoremove -y` commands. These actions directly contradict the explicit security recommendations in `SKILL.md` and `docs/sudoers.md`, which state that `apt-get install` and `apt-get autoremove` permissions should *not* be granted. This discrepancy creates a significant vulnerability: if the user's sudoers configuration is less restrictive than recommended (e.g., `NOPASSWD: ALL`), these commands could be exploited for Remote Code Execution (RCE), allowing arbitrary package installation or removal. While the script's intent appears to be maintenance, this critical inconsistency between code and documented security policy makes the skill suspicious due to the high-risk capability.