Teamo Lite Offline

• Analyzed: May 12, 2026, 4:05 AM
• Findings: 1
• Version: 0.1.0
• Hash: 2dff99d215df9623cb66601dfc83ee5914d8cbd569279b5a4c1ecaaadacbbad2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `SKILL.md` instructions explicitly mandate the use of the `url_scraping` tool for 'complex tasks' within Workflow 2. This creates a significant vulnerability where a malicious user could craft a prompt to force the AI agent to perform Server-Side Request Forgery (SSRF) or potentially exfiltrate data by scraping internal network resources or sensitive URLs. Additionally, the skill allows `call_other_agents` in Workflow 2, which could extend the attack surface if chained with other agents. These capabilities, while potentially intended for legitimate 'online information gathering,' pose a high risk of prompt injection leading to unauthorized access or data leakage.