mt5_trade

• Analyzed: May 12, 2026, 4:09 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0eb0a8ad9abb24b66a39f3de4f93a0962dddd6bccb6f786fe1133c47cb16ad82
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is suspicious due to a significant shell injection vulnerability (RCE risk) in SKILL.md. The instructions explicitly tell the AI agent to construct PowerShell commands by dynamically inserting JSON payloads (e.g., '<PASTE_DRAFT_JSON_HERE>' for /order_confirm) without any mention of sanitization or escaping. If an attacker can control the content of the JSON payload, they could inject arbitrary PowerShell commands, leading to remote code execution. While the stated purpose is to interact with a local trading API, this critical flaw allows for exploitation beyond the intended functionality.