MAC OS screenshot to telegram

• Analyzed: May 12, 2026, 4:08 AM
• Findings: 1
• Version: 1.0.0
• Hash: 63d5538ddff8e7f430effd82b97428c73b0b40bf55773a67351bb2ef0db561e2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for a legitimate purpose (screenshot to Telegram). However, the `scripts/screenshot-telegram.sh` file is vulnerable to shell injection and path traversal. The user-controlled `PROFILE` parameter is directly concatenated into file paths (`CONFIG_PATH`, `WORKSPACE`) without sanitization, and these paths are then used in shell commands (`grep`, `sed`, `screencapture`, `curl`). This allows an attacker to potentially execute arbitrary commands or access/write files outside the intended directories by crafting a malicious `PROFILE` value.