CRM-in-a-Box

• Analyzed: May 11, 2026, 4:50 AM
• Findings: 1
• Version: 0.1.0
• Hash: 3574fd511d555c7563ccff1739e21e6d92e7649eac2a0b4582ccda41aff0c010
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` file contains agent instructions that execute shell commands, specifically `grep` and `cat` piped to `python3`. The `grep` command, `grep -i "name" contacts.ndjson | python3 -m json.tool`, presents a significant shell injection vulnerability (RCE risk) if the `name` parameter is derived from unsanitized user input. While these commands are intended for legitimate data processing within the CRM skill, the lack of explicit input sanitization instructions for the agent makes this a high-risk capability, classifying it as suspicious rather than benign due to the potential for exploitation.