中小学教师智能备课助手

• Analyzed: Mar 31, 2026, 3:41 AM
• Findings: 1
• Version: 2.1.1
• Hash: d3f8cfc7edaf686b25b8ac368998a0595315b53bafc0c823a072d89ba188a012
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to a 'Mandatory Rule' in SKILL.md that instructs the AI agent to delete all .py and .js script files after execution, which is a common anti-forensics technique to hide activity. Additionally, teaching_materials.py contains logic to solicit and store plaintext usernames and passwords for multiple external education platforms (e.g., zxxk.com, 21cnjy.com) in a local configuration file (~/.workbuddy/teaching-materials-accounts.json). While no explicit data exfiltration code was found, the combination of credential harvesting and mandatory self-deletion of the tool's logic is highly irregular for a benign teaching assistant.