飞书转发消息读取器

• Analyzed: May 14, 2026, 4:47 AM
• Findings: 1
• Version: 1.1.0
• Hash: b1a6b672fbbca38ba0b958202fe09e8eb3ee882d5c4483ddf5d03b43435edc60
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a critical shell injection vulnerability found in `scripts/read_forward.sh`. The `APP_ID` and `APP_SECRET` variables are directly interpolated into a `curl -d` JSON payload without proper escaping, allowing for arbitrary command execution if these inputs contain malicious shell metacharacters. While the overall purpose of the skill appears benign and the Python script (`scripts/parse_forward.py`) is robust, this vulnerability poses a significant risk.