Korean Invoice

• Analyzed: May 12, 2026, 4:10 AM
• Findings: 1
• Version: 1.0.0
• Hash: 04e84680ae55b63cbed7540c70d0f8fae42084b78af88d122f4cfa4f0ad55d2c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to significant vulnerabilities related to input sanitization and potential path traversal. The `scripts/generate.js` script directly inserts user-controlled data (e.g., client names, item descriptions, notes) into HTML templates without proper escaping. This creates an HTML Injection/Cross-Site Scripting (XSS) vulnerability, where malicious HTML/JavaScript injected into these fields could execute within the `puppeteer-core` controlled browser (connecting to `http://localhost:18800`). Such an exploit could potentially lead to local file access or network requests from the browser's context. Additionally, the construction of output filenames in `scripts/generate.js` using user-controlled `client.name` (which is not sanitized in `scripts/manage-clients.js`) could allow for path traversal, enabling an attacker to write files outside the intended `output/` directory. While there's no clear evidence of intentional malice, these vulnerabilities pose a significant risk.