WeatherPanel Note AI PC

• Analyzed: May 16, 2026, 7:48 AM
• Findings: 1
• Version: 1.0.2
• Hash: 3d9e5fab5a6c8960499913b95dd70cac95ad679444960906a621b674addee43f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a shell injection vulnerability in `scripts/summarize_weather.py`, where `subprocess.run` is invoked with `shell=True` on a command string constructed from parameters (latitude, longitude, etc.) that can be influenced via a local JSON configuration file. While the developer included a comment suggesting this was intended to handle special characters in URLs on Windows, it creates a risk of arbitrary command execution. The rest of the bundle, including weather data retrieval from Open-Meteo and Obsidian integration via `scripts/flush_to_obsidian.py`, appears to follow the stated purpose without evidence of intentional malice or data exfiltration.