Memory Compress

• Analyzed: May 11, 2026, 6:28 AM
• Findings: 1
• Version: 1.2.1
• Hash: df504dbf986c03b553e2fbdbb86e278c7b4b1a94bde86260d1feb35721cb7619
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a path traversal vulnerability in `scripts/memory-compress.js` because it uses `path.resolve(WORKSPACE, DAILY_LOG)` and `path.resolve(OUTPUT)` without validating that the resulting paths remain within the intended workspace. This allows the script to read from or write to arbitrary locations on the filesystem if the input arguments are manipulated. While the code lacks evidence of intentional malice, such as network exfiltration or obfuscation, the insecure file handling is a high-risk flaw.