1688 Distribution

• Analyzed: May 6, 2026, 2:46 AM
• Findings: 1
• Version: 0.1.0
• Hash: ba36b69ce3f374633140d83111412a49ed58c128969c243b7d940ffcbc0ff178
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains several high-risk capabilities, including a background HTTP callback server (`_callback_server.py`) and a discovery module (`_skill_discovery.py`) that performs reconnaissance by scanning the user's home directory for other installed skills. The `SKILL.md` instructions direct the AI agent to handle Access Key (AK) authorization "silently" and explicitly forbid displaying authorization URLs to the user, mandating automated browser use instead. While these behaviors are consistent with the stated goal of automating 1688 distribution tasks, the use of background processes, local network listeners, and broad file system reconnaissance represents a significant security risk without clear evidence of malicious intent.