Email Audio Analyzer

• Analyzed: May 10, 2026, 6:28 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2eab32b515a566a96a7fda6d149e2077c915625e0aadf6b24de7b63a0537a231
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains several high-risk patterns and vulnerabilities. Most notably, it uses `execSync` in `check-email.js`, `transcribe.js`, and `analyze.js` to execute shell commands with unsanitized inputs (such as email IDs and filenames), creating a significant Command Injection risk. Additionally, `analyze.js` contains a hardcoded API key (`sk-sp-3c082728a4b0456d9aebca5a718252cb`) and attempts to read sensitive authentication files from the local filesystem (`auth-profiles.json`). While the behavior appears consistent with the stated purpose of processing Lithuanian audio emails, the lack of input sanitization and hardcoded identifiers (including a specific Telegram chat ID `1341107300`) make it dangerous in its current state.