Gong

• Analyzed: May 12, 2026, 3:02 AM
• Findings: 1
• Version: 1.1.0
• Hash: d337f22b51276520728802371b07c78f6f0ad7cb6aad5d812638bb1ba23c09d6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to interact with the Gong API, requiring credentials stored in `~/.config/gong/credentials.json`. Both `SKILL.md` and `scripts/gong.sh` demonstrate standard API interaction patterns using `curl` and `jq`. The `SKILL.md` file contains no prompt injection attempts. The `gong.sh` script uses standard shell utilities and does not exhibit any signs of data exfiltration to unauthorized endpoints, malicious execution, persistence mechanisms, or obfuscation. While user input for `call_id` is directly embedded into a JSON string in `gong.sh`, this is unlikely to lead to shell injection due to `curl -d` quoting and would primarily result in API errors rather than local code execution or data compromise, thus not meeting the threshold for 'suspicious' or 'malicious' behavior.