terry-camsnap

• Analyzed: May 4, 2026, 4:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5ca36ef34f6981962fd7fe8f216b84b7e49574604bb0505da2df1da605854f97
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a shell injection vulnerability in SKILL.md, where user-provided arguments are passed directly into a Bash command string (python3 ... {{ $ARGUMENTS }}). While the stated purpose of taking webcam snapshots is legitimate, the lack of argument sanitization allows for potential command execution. Additionally, the skill interacts with sensitive hardware (webcam) and references an external script (camsnap.py) not provided in the bundle.