Aliyun Web Search

• Analyzed: May 12, 2026, 4:25 AM
• Findings: 1
• Version: 1.0.0
• Hash: 9144ecff8efeb2963644bfd1d8ff59f7509470f6452dc1c678aeecd86ad56f6f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a lack of input sanitization in `scripts/search.sh`. The `$QUERY` variable, which is user-controlled input, is directly embedded into the JSON payload without proper escaping. While this does not appear to lead to local shell injection due to how the shell handles heredocs and quoted variables, it represents a JSON injection vulnerability against the remote Aliyun API, potentially allowing a malicious user to craft queries that break the JSON structure or inject unintended fields. The `SKILL.md` is well-written and does not contain prompt injection attempts.