Hsk Learning

• Analyzed: May 12, 2026, 4:18 AM
• Findings: 1
• Version: 1.0.1
• Hash: 855b8e44f341253b8961f6210769ed14af0b25247bce9981ad4ae90b6fdf43b1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The HSK learning skill bundle contains a path traversal vulnerability in the `hsk_parse_quiz_log` function (found in `index.js` and `lib/parser.js`). The `filePath` parameter, which is user-controlled, is directly used with `path.join` and `fs.readFileSync` without proper sanitization against `../` sequences. This allows an attacker to read arbitrary files on the host system, which is a significant vulnerability, classifying the skill as suspicious despite no clear evidence of intentional malicious behavior like data exfiltration or persistence.