Github Collab

• Analyzed: May 15, 2026, 8:02 AM
• Findings: 1
• Version: 0.1.5
• Hash: a297d20fed947e431e48117d5c0a2a82b468a7340aa040d048c3e8db33387ae8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a comprehensive framework for GitHub collaboration but contains high-risk execution patterns and vulnerabilities. Specifically, `src/scripts/main.js` and `src/scripts/scheduler.js` utilize `child_process.execSync` with unsanitized variables in template literals (e.g., repo names and task titles), creating a significant shell injection surface. Additionally, `src/db/config-sync.js` implements a self-modifying code pattern by programmatically overwriting `src/agent-addresses.js`. While these behaviors are functionally aligned with the stated purpose of GitHub automation, the combination of shell execution risks and source code modification is inherently risky.