1688 Sourcing Inquiry

• Analyzed: May 10, 2026, 6:44 AM
• Findings: 1
• Version: 0.1.0
• Hash: 7b14134049848693f419f485130a934897ce7ad355b1475c2d2dd0c8d44c1092
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a legitimate interface for 1688 procurement and sourcing inquiries. It implements a comprehensive authentication system supporting both OAuth 2.1 (with PKCE) and Access Key (AK) methods, utilizing a local callback server (scripts/callback_server.py) and secure storage via the OS Keychain or local files (scripts/secure_store.py). All external communication is directed to official 1688 infrastructure (skills-gateway.1688.com), and the telemetry reported in scripts/_tracker.py is limited to usage statistics sent to the same gateway. The instructions in SKILL.md are well-defined, focusing on intent recognition and preventing hallucination without any signs of prompt injection or malicious redirection.