Voice Memo

• Analyzed: May 11, 2026, 4:49 AM
• Findings: 1
• Version: 0.1.2
• Hash: ad83ff2bbe7a85846767f79b13a229fb66297c5077a12613e707fb4231a790a0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The `scripts/send-voice-memo.sh` file contains a shell injection vulnerability. The `RECIPIENT` variable, which can be controlled by user input, is directly embedded into the `CHAT_GUID` string and then passed as a `--form-string` argument to `curl` without proper shell escaping. This allows an attacker to inject arbitrary shell commands by crafting the recipient phone number, leading to potential remote code execution. There is no evidence of intentional malicious behavior such as data exfiltration or persistence mechanisms.