Gen Music

• Analyzed: May 11, 2026, 6:05 AM
• Findings: 1
• Version: 0.1.0
• Hash: d7b0eccf5b63e907f2f51271c2ea49e8c476f7f60fded08317f330ee32e61b6d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The script `scripts/generate.py` contains a path traversal vulnerability in the `local_source_path` and `save_outputs` functions. It blindly trusts file paths or query parameters returned by the API backend, allowing a potentially malicious or compromised server to trigger the copying of arbitrary local files (e.g., sensitive configuration or identity files) into the skill's output directory. While this behavior is documented in `SKILL.md` as a convenience for local API integration, the lack of input validation on the source paths poses a significant risk of local data exposure.