Thought-Retriever

• Analyzed: May 2, 2026, 8:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: deb987a57fd6f7860d6c16bd4502a30d26632e8c82afde567bd723d3b7573b8f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains a hardcoded API key (sk-b841f4b7...) and hardcoded absolute Windows file paths (C:/Users/89627/...) in thought_retriever.py, which are significant security and portability risks. Furthermore, the script explicitly disables system proxy settings (session.trust_env = False) when transmitting user conversation data to an external endpoint (dashscope.aliyuncs.com), a behavior that can be used to bypass network security monitoring. While the functionality aligns with the documentation, these implementation choices are highly irregular and risky.