Douyin To Obsidian

• Analyzed: May 13, 2026, 2:11 PM
• Findings: 1
• Version: 1.0.2
• Hash: 187ad0de33dcde772b1dcee8354943b603c26156d0d88ca9085ef2af6c81a48c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a hardcoded Groq API key in `config.json`, which is a significant security oversight. Furthermore, the `SKILL.md` instructions present a high risk of shell injection; they direct the agent to fetch a URL and a title from a third-party website (Douyin) and pass them directly into shell commands (`curl` and `obsidian` CLI) without sanitization. This could allow a malicious webpage to execute arbitrary commands on the host system if the agent processes a crafted URL or title.