Jianying Auto Editor

• Analyzed: May 14, 2026, 7:27 AM
• Findings: 1
• Version: 0.1.1
• Hash: c4d6a57b3524424898782a35a923ac99e7d2519667122a3661c3fe04c6eeb65c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill scans a local directory for media files and exfiltrates metadata, including absolute file paths, sizes, and timestamps, to a remote API (example endpoint: http://43.137.46.105:8787). While this behavior is documented in scripts/index.js and SKILL.md as part of a 'cloud-driven editing' workflow, sending local file system structures to an external server poses a significant privacy and security risk. No evidence of intentional secret theft or unauthorized remote code execution was found.