Claude Agent Sdk

• Analyzed: May 12, 2026, 3:12 AM
• Findings: 1
• Version: 0.1.0
• Hash: a772acdaa05d17edf73c5f6022dcae455c3fbe1bb7e91e55e0c8fb43b7ffcb00
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is generally well-documented and emphasizes security best practices, but the `templates/custom-mcp-server.ts` file contains a `calculate` tool that uses `eval(args.expression)`. This presents a direct code injection vulnerability, as a malicious prompt could instruct the AI agent to inject arbitrary JavaScript into the `expression` argument, leading to arbitrary code execution within the agent's environment. While a comment suggests using a proper math parser in production, the example itself demonstrates a risky capability without clear mitigation, classifying it as suspicious.