Smart Search Fallback

• Analyzed: Apr 29, 2026, 3:28 PM
• Findings: 1
• Version: 1.0.0
• Hash: 6e523ded626ece3cac8eac4d331b9958fac4264c688df797eae300178e850b54
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a search fallback mechanism but contains a shell injection vulnerability in `scripts/fallback-search.sh`. Specifically, the `$QUERY` variable is expanded directly into a Python script executed via `python3 -c` in the T3 fallback block, which allows for arbitrary Python code execution if a user provides a crafted search query. While the intent appears to be functional (improving search reliability), the lack of input sanitization in the shell script poses a significant security risk.