discord voice memo upgrade

• Analyzed: May 12, 2026, 3:08 AM
• Findings: 1
• Version: 1.0.0
• Hash: 8ef1ff22e805d500790bd83deba976605393ee1f06c5b2286bd59fe94bee7802
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the presence of extensive `console.log` debug statements in `patch/dispatch-from-config.js` and `patch/tts.js`. These logs output internal state, including truncated message bodies (`Body`) and API key status (e.g., `apiKey=SET(xxxx...)` or `MISSING`). While the documentation (`SKILL.md`, `README.md`, `PATCH.md`, `CHANGELOG.md`, `UPLOAD.md`) explicitly states these are debug logs and should be removed for production, their inclusion constitutes a risky capability that could expose sensitive information if deployed without modification. There is no clear evidence of intentional malicious behavior or unauthorized data exfiltration to external endpoints, as API keys are used for legitimate TTS services and the instructions are for manual patching by a human administrator, not for AI agent prompt injection.