中文 网站部署

• Analyzed: May 8, 2026, 10:06 AM
• Findings: 1
• Version: 2.0.0
• Hash: 3ce00fc6cb9472a641f20787a8e4493260483ac363f6ed9dc7a2682f1e8f40f6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a workflow for deploying websites using Docker and SSH, which requires high-risk permissions such as 'exec' and 'write'. While the behavior aligns with the stated purpose, the deployment templates in SKILL.md are vulnerable to shell injection because they use unquoted variables (e.g., $PROJECT, $USERNAME) in shell commands. There is no evidence of intentional malice, but the lack of input sanitization and the requirement for Docker Hub credentials and server access present a significant security risk.