Math Worksheets

• Analyzed: May 11, 2026, 4:34 AM
• Findings: 1
• Version: 2.0.0
• Hash: 35a6ee31e23712b04274e8ba32969e1b898f8f54010a0d5240d077a51cc25c63
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill appears benign. It generates math worksheets using LaTeX and verifies answers with SymPy. The `SKILL.md` instructions are clear and task-oriented, without any prompt injection attempts to manipulate the agent into unauthorized actions. Crucially, the `scripts/verify.py` script, which processes AI-generated content, uses `sympy.sympify` for safe mathematical expression parsing instead of `eval()` or `exec()`, explicitly addressing a potential RCE vulnerability from previous versions as noted in `README.md`. All shell commands executed (`brew`, `tectonic`, `python3`, `lpr`) are for legitimate skill functionality, and there are no network calls for executable content or signs of data exfiltration, persistence mechanisms, or obfuscation.