web-front

• Analyzed: May 2, 2026, 1:19 PM
• Findings: 1
• Version: 1.0.0
• Hash: 8eecb10f43882649db4427fa217aaca415c923792af307cab0c7b43dc89b3968
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a web front-end generator with extensive file management capabilities, including the use of high-risk system commands like 'rm -rf' for project deletion and 'start/open/xdg-open' for browser previews (SKILL.md). While these features align with the stated purpose, the instructions lack explicit safeguards or sanitization for user-provided project names, creating a significant surface for path traversal or unintended file deletion. Additionally, the 'learning mechanism' involves the agent autonomously reading and updating local markdown files, which could be exploited via prompt injection to manipulate the agent's behavior or access unauthorized directories.