Slybroadcast Voicemail

• Analyzed: May 12, 2026, 4:04 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5d8b51cecbd1bbd4aec73d4ca1e29ebb82bb18803ab45d2817b8ae05d22ec5f9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to several inherent risks, even though no explicit malicious intent or prompt injection is found in SKILL.md. It requires access to multiple sensitive API keys (Slybroadcast, ElevenLabs) and instructs the agent to fetch audio from arbitrary URLs, which could be exploited for SSRF or fetching malicious content. Additionally, it requires staging local and AI-generated audio files to be publicly reachable, increasing the attack surface if sensitive data is inadvertently exposed. While these capabilities are plausibly needed for the stated purpose, they introduce significant security considerations and potential for misuse or exploitation if the agent's execution environment or input sanitization is flawed.