ai-drama-prompt-factory

• Analyzed: May 11, 2026, 4:45 AM
• Findings: 1
• Version: 1.0.0
• Hash: 76044e512fbdb93e97da26df543df54d5ae5e05d063d03982dddeef6c5e085fe
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed for generating AI drama prompts, which is a benign purpose. However, the Python utility scripts (`doc_fetch.py`, `doc_indexer.py`, `doc_search.py`, `doc_summarize.py`) handle file paths directly from command-line arguments without explicit input sanitization. This creates a significant vulnerability for arbitrary file read (and potentially write for `doc_indexer.py`) if a malicious user or a prompt-injected agent provides crafted file paths (e.g., using directory traversal `../` or absolute paths like `/etc/passwd`). While the scripts themselves do not exhibit malicious intent (no data exfiltration, persistence, or unauthorized network calls), this vulnerability allows for potential exploitation of the host system's file system, classifying the bundle as suspicious.