DubbingHub

• Analyzed: May 11, 2026, 6:53 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7a6c38a590ea991c5e2ebffe445fb8c829b59b89b983077c894714b3ae9b7acd
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates video translation via an external service (audiox-api-global.luoji.cn). It is classified as suspicious due to a shell injection vulnerability in 'scripts/curl_examples.sh'. The script uses unquoted heredocs to construct JSON payloads, which allows for arbitrary command execution via shell expansion of the 'VIDEO_SOURCE' variable if a user provides a maliciously crafted URL or file path. While the skill's instructions in 'SKILL.md' and 'agents/openai.yaml' align with its stated purpose, the lack of input sanitization in the provided execution script poses a significant security risk.