biz-in-a-box

• Analyzed: May 10, 2026, 4:47 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8278d8885dc2fcbc9391c337a8e8cb8d7dcac3d199750d6869063c465c01ac41
• Source: palm
• External report: View on VirusTotal

Findings (1)

The SKILL.md file instructs the AI agent to execute `git clone https://github.com/taylorhou/biz-in-a-box` from an external GitHub repository and then run `node validate.js` from the cloned directory. This constitutes a significant Remote Code Execution (RCE) vulnerability and a supply chain risk. If the external repository were compromised, the agent would download and execute arbitrary malicious code, even though the stated purpose of the skill (business ledger management) appears benign.