Telegram Offline Voice

• Analyzed: May 14, 2026, 3:08 AM
• Findings: 1
• Version: 0.1.3
• Hash: 5c67b4ac9faf98e56060301f7468965f15e3ede49548941e02da5a1218f7c113
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the use of `curl -LsSf https://astral.sh/uv/install.sh | sh` in both `SKILL.md` and `README.md` for installing the `uv` dependency. While `uv` is a legitimate tool and its installation is plausible for the skill's stated purpose, this method of executing remote code directly from the internet is a high-risk practice that bypasses integrity checks and introduces a supply chain vulnerability. The core Python script (`scripts/voice_gen.py`) itself appears benign, performing its stated function of text-to-speech and audio conversion using `ffmpeg` without evidence of malicious intent.