Webhook Promo Scheduler

• Analyzed: May 15, 2026, 4:18 AM
• Findings: 1
• Version: 0.1.1
• Hash: 15d94faba5f02b17521c3c01285b0d84761643e6836484343b401f5ad9283979
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to post messages to a Discord webhook, which inherently involves network communication. While it includes positive security measures like redacting webhook URLs from logs and output, it has a significant vulnerability: the `scripts/promo_scheduler.py` script's `read_messages_file` function can read content from any user-specified file path (`--messages-file`). This content is then treated as messages and sent to a user-specified Discord webhook URL. An attacker who can control the `--messages-file` and `--webhook-url` arguments could exploit this to exfiltrate arbitrary local files (e.g., `/etc/passwd`, `~/.aws/credentials`) to an attacker-controlled endpoint. This constitutes a critical data exfiltration vulnerability, classifying the skill as suspicious due to the potential for misuse, even if the intent of the original author was benign.