Health Guide

• Analyzed: May 12, 2026, 4:34 AM
• Findings: 1
• Version: 1.0.1
• Hash: c3ab948ec7cd445b38b1ff91234ddc4406d83babbfa2008335187464c0c2fc59
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to a significant shell injection vulnerability. The `playbook.md` file explicitly instructs the AI agent to execute a shell script (`bash skills/hira-hospital/scripts/hospital_search.sh "[지역]" "[진료과]"`) using user-provided input for `[지역]` and `[진료과]`. This direct execution of shell commands with untrusted input creates a high risk of Remote Code Execution (RCE) if the agent does not perform robust input sanitization. While the overall purpose of the skill (health information) appears benign and there's no evidence of intentional malicious behavior like data exfiltration or backdoors, this vulnerability is a critical security flaw.