Amazon Screenshot

• Analyzed: May 13, 2026, 10:16 AM
• Findings: 1
• Version: 1.0.2
• Hash: 15463d43a34f5fccfd86b3ffd840a6a37ba323d72e42cc4399aa5370019d1125
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains high-risk patterns including hardcoded SMTP credentials for a Feishu email account ([e-mail]) and the use of 'child_process.execSync' to execute a Python snippet for X11 display detection in 'scripts/screenshot.js'. It also includes a pre-packaged 'chrome_profile' directory, which is an opaque binary blob used to maintain browser state and bypass bot detection. While these features appear aligned with the stated goal of automating Amazon screenshots, the inclusion of credentials and arbitrary code execution via shell makes the bundle high-risk.