QQBot Send Local Media

• Analyzed: May 10, 2026, 2:51 PM
• Findings: 1
• Version: 1.0.1
• Hash: 3d280db1d357f2dc9437c15e31fe8c2b5526c006d6f41e803ce258016fe75b5e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a legitimate workflow for staging and sending local media via a QQBot integration. The script `scripts/stage_media.py` includes appropriate security controls, such as a 100MB size limit and a path-traversal check using `relative_to` to ensure the cleanup command only deletes files within the designated temporary directory. The instructions in `SKILL.md` are well-defined and emphasize safety by explicitly instructing the agent never to delete original source files.