Dele Deploy

• Analyzed: Apr 3, 2026, 10:11 AM
• Findings: 1
• Version: 1.0.5
• Hash: 1c49e23d02e769b0b81afaef682bcc00119a49b88a663b3c5bfc93ee4164695f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill 'dele-deploy' (implemented in postme_deploy.py) allows an AI agent to upload local files or entire directories to an external hosting service (dele.fun). While this aligns with its stated purpose of deploying frontend projects, the tool lacks any path validation or restrictions, creating a high-risk vector for data exfiltration if the agent is directed to upload sensitive directories like ~/.ssh or project secrets. Additionally, the 'api_url' parameter is configurable, which could allow a prompt-injection attack to redirect the uploaded data to an unauthorized third-party endpoint.