W-Spaces Deploy

• Analyzed: May 18, 2026, 8:59 AM
• Findings: 1
• Version: 1.0.0
• Hash: 01c0f0ab83ef71afe29c420d350955457d3df9d393d2d46dc9fc63697db9c1f1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a set of tools for deploying static websites to wspaces.app, but it contains several security vulnerabilities. Specifically, `wspaces_auth.sh` and `wspaces_project.sh` manually construct JSON payloads using unescaped shell variables, which is a classic JSON injection vulnerability. Furthermore, `wspaces_auth.sh` encourages passing sensitive passwords as command-line arguments, which can expose them in system process lists. While the core logic appears to serve its stated purpose and `wspaces_push.sh` correctly uses Python for JSON escaping, the lack of consistent input sanitization across the bundle poses a risk in an AI agent environment.