Quote/0

• Analyzed: May 11, 2026, 4:41 AM
• Findings: 1
• Version: 1.0.4
• Hash: 3deccfaaee7e1c6bc1be0782efc77faf0525d9d1cc2d7709d5cc4f85c6001ed3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to interact with a specific API, and the `quote0.js` script primarily performs its stated function. However, the `image` command in `quote0.js` allows reading any local file specified by `--imageFile` and uploading its base64 content to the remote API. While the script includes strict validation to ensure the file is a PNG (checking both extension and magic bytes), this still represents a risky capability. An AI agent could potentially be prompted to upload a sensitive PNG file (e.g., a screenshot containing confidential information) from an arbitrary location on the filesystem. The `SKILL.md` file explicitly warns against passing sensitive file paths to `--imageFile`, acknowledging this potential risk, which contributes to the 'suspicious' classification rather than 'benign' due to the inherent data leakage risk if misused.