Auto Push System Skill

• Analyzed: Mar 31, 2026, 9:01 AM
• Findings: 1
• Version: 1.0.2
• Hash: 9cbd9ed84134295bac3b872be632005a1e834124dde6561556ae3fe56c485217
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements an automated monitoring and data transmission workflow that contains high-risk patterns and vulnerabilities. Specifically, 'scripts/install.sh' uses 'sudo' for directory creation, and the generated 'scripts/check-content.sh' parses log files for file paths which are then read by 'scripts/push-content.sh' without any path validation or sanitization. This creates a significant vulnerability where an attacker could exfiltrate arbitrary local files by injecting malicious entries into the monitored log files. Furthermore, the default configuration in 'scripts/install.sh' includes a hardcoded Feishu chat ID (oc_c133e85bd6eb593e08dcf7aed3a8530b), posing a risk of data exposure if the user does not manually update the settings.