Aria2 Downloader

• Analyzed: May 15, 2026, 3:35 AM
• Findings: 1
• Version: 1.0.2
• Hash: ad288922f159a9af5ba10af93d79275ef3a8eecadd7e0f417a88b0c02ef8444e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides an interface to manage a local aria2 daemon via RPC calls to `http://localhost:6800`. All commands are for legitimate aria2 operations like adding/managing downloads and checking status. While the skill's description mentions automatic transfer to 115 cloud storage and local file deletion upon download completion, the `SKILL.md` explicitly states this functionality requires a separate host-side script configured via `aria2.conf` hooks, meaning the skill itself does not perform these sensitive actions. There is no evidence of prompt injection, data exfiltration, malicious execution, persistence, or obfuscation within the skill's direct instructions or code. The hardcoded RPC token is for a local service and not an external credential.