Shipping Calc

• Analyzed: May 11, 2026, 6:12 AM
• Findings: 1
• Version: 3.0.0
• Hash: c990d5897fa6adc63249f4e523594dec9e8c80da489abdf68b8e936ad403f076
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains multiple critical command injection vulnerabilities in `scripts/script.sh`. Specifically, the `rate`, `compare`, `estimate`, and `duty` functions pass unsanitized shell arguments directly into `awk` command strings (e.g., `awk "BEGIN{...$2...}"`), which allows for arbitrary code execution if a user provides crafted input. While the script's logic aligns with its stated purpose and lacks explicit evidence of intentional malice or exfiltration, the high-risk nature of these vulnerabilities warrants a suspicious classification.