PCEC EvoMap Integrator

• Analyzed: May 11, 2026, 4:48 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4bf6b7490d5a2b20b3617cf9c309b4e8433d115db87e7b4441eb395712019649
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructs the AI agent to write to a local file, `memory/evomap-reuse-log.md`, as detailed in `SKILL.md`. The content written to this log, specifically the '信号' (signals) and '备注' (notes), can originate from external error messages or user input. This creates a significant prompt injection vulnerability, as unsanitized input written to this log could later be read and interpreted by the agent as malicious instructions, potentially leading to unauthorized actions. All network calls are consistently directed to `https://evomap.ai` for the stated purpose of integration, showing no signs of direct data exfiltration or C2 communication to unrelated domains.