Urlopnik

• Analyzed: May 4, 2026, 12:07 PM
• Findings: 1
• Version: 2.2.0
• Hash: ced4be7398905e3edbfed718f5b235406faf9295c4222dc03c1492663a105024
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a script (generate_pdf.py) that uses subprocess.run to automatically install the 'reportlab' library via pip if it is not found. While this is intended to facilitate PDF generation, executing shell commands to install external dependencies at runtime is a high-risk behavior that can lead to unauthorized code execution or supply chain vulnerabilities. The rest of the logic in main.py and urlopnik.py appears benign and consistent with the stated purpose of managing Polish leave requests.