Cross-Agent Memory Sharing

• Analyzed: May 11, 2026, 5:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9eb9a01e0cbb9cc9f57ace56ee662e5e7823b404e82f4422d72c9c499f16c1fb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `sync.mjs` script is highly suspicious due to critical shell injection vulnerabilities. It uses `execSync` with unsanitized input from `process.argv[3]` for Git commit messages, allowing arbitrary command execution if an attacker controls the message. Additionally, the `SHARED_MEMORY_REPO` environment variable, if controlled, could lead to shell injection during the `git clone` operation. While the skill's stated purpose of cross-agent memory sharing via Git is benign, these implementation flaws pose a significant remote code execution risk.