AI Interview

• Analyzed: May 11, 2026, 4:56 AM
• Findings: 1
• Version: 1.0.2
• Hash: 141e96018c2cb09111c5466fd04e76c4b4001248cf4ef3324d7343a885e61273
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a path traversal vulnerability in `run.js`. The script directly uses the user-provided `folder` argument in `fs.readdirSync` without sanitization or explicit path validation. If an AI agent allows arbitrary paths for this input, an attacker could supply a path like `/etc` or `~/.ssh`, potentially leading to the unauthorized upload of sensitive system files or user credentials to the third-party Fuku.ai service. While the `SKILL.md` instructs the agent to use a folder 'inside the workspace', the `run.js` code does not enforce this constraint. There is no evidence of intentional malicious behavior such as backdoors, unrelated data exfiltration, or obfuscation.