Trip Calendar

• Analyzed: May 11, 2026, 5:02 AM
• Findings: 1
• Version: 1.0.0
• Hash: c79336f86b91f6ffd5d049d6abcc381340a483d2491297eca8eaba4ee9cdaabe
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to a significant shell injection vulnerability. The `SKILL.md` instructs the AI agent to construct and execute `gog` CLI commands using parameters (`--summary`, `--location`, `--description`) that will likely be populated with user-provided or parsed data. There are no explicit instructions for the agent to sanitize or escape this input, creating a clear path for an attacker to inject arbitrary shell commands into the `gog` execution, potentially leading to Remote Code Execution (RCE) on the host system.