1688 Shop Operate

• Analyzed: May 10, 2026, 6:49 AM
• Findings: 1
• Version: 0.1.0
• Hash: 1425d774338e25d4ca76ea7b86065ef79ac836b0ac85e18550c5dc9d23d203c1
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is a legitimate tool for 1688 shop diagnosis and management. It implements professional security practices for handling sensitive credentials, including device-bound encryption (using PBKDF2, SHA-256 CTR, and HMAC-SHA256 in ak_crypto.py) and integration with OS Keychains via the 'keyring' library. The authorization flow uses standard OAuth 2.1 with PKCE (scripts/pkce.py) and a local callback server (scripts/callback_server.py) to securely capture tokens. All network communication is directed to the official 1688 skills gateway (skills-gateway.1688.com), and no evidence of data exfiltration, malicious execution, or harmful prompt injection was found.