Pmos Search Menu Skill

• Analyzed: May 11, 2026, 7:06 AM
• Findings: 1
• Version: 1.0.1
• Hash: 637e21206ae01c4c67b82c43723fe6331fdd2754d5e4bcea51b7ccff29c813c7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates navigation on the Gansu Electric Power Trading Platform (PMOS) website. It is classified as suspicious due to a command injection vulnerability in `scripts/navigate-pmos.js` and `scripts/navigate-pmos.sh`, where user-provided element references are directly interpolated into shell commands (via `execSync` in Node.js and direct execution in Bash) without sanitization. While the behavior aligns with the stated purpose of the tool, this flaw allows for arbitrary command execution if a user provides a crafted input string.