Publish Website Traefik

• Analyzed: May 8, 2026, 9:36 AM
• Findings: 1
• Version: 1.0.0
• Hash: 39f3d27febb5773b750258626fa2219cf56007755aa0e9d97a93b66cb97fa3ae
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides scripts for deploying static websites using Docker and Traefik, but contains significant shell injection vulnerabilities in `scripts/deploy_site.sh` and `scripts/delete_site.sh`. Specifically, the `SUBDOMAIN` and `WEBSITE_PATH` arguments are used within double-quoted strings and heredocs without sanitization, allowing for arbitrary command execution (e.g., via backticks or command substitution) when the variables are evaluated by the shell. While the functionality aligns with the stated purpose of website management, these flaws could be exploited to execute unauthorized commands on the host system.