Wecom Voice

• Analyzed: May 11, 2026, 7:15 AM
• Findings: 1
• Version: 1.0.0
• Hash: d6435d2cb8a9e5afa8cecac42c4c78335543bc0993fe79ac598a52a7ab6fc863
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains multiple command injection vulnerabilities in `scripts/send-voice.cjs`. It unsafely interpolates user-provided arguments (`text` and `targetUser`) into shell commands and a PowerShell script executed with `-ExecutionPolicy Bypass`. While the script's logic aligns with its stated purpose of sending WeCom voice messages, the lack of input sanitization allows for arbitrary code execution. No clear evidence of intentional malice or data exfiltration was found, but the implementation is highly insecure.