Arxiv Skill Learning

• Analyzed: May 12, 2026, 4:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 019f91d53bb65c032e619394463a141c9ca37eb34ce4dfeda1796a425217d5e5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `arxiv-skill-learning` skill is classified as suspicious due to a critical shell injection vulnerability in `index.js`. The skill executes a `smokeTestCommand` generated by the `arxiv-skill-extractor` skill using `child_process.exec` without apparent input sanitization. This allows for arbitrary command execution on the host system if the `arxiv-skill-extractor` skill is compromised or intentionally malicious, as the command is run from the `WORKSPACE_ROOT` with broad access, enabling potential RCE.