Skill Router

• Analyzed: May 14, 2026, 4:46 PM
• Findings: 1
• Version: 2.1.1
• Hash: aebace078c35dfa31b8a4b50d24843379c572ddbc448a9533a340b11ee35e558
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains multiple hardcoded API keys and credentials within 'tool_catalog.json' for services including PubMed, Semantic Scholar, TinyFish, and Zotero, as well as a specific 163.com email account. The system design encourages the AI agent to execute arbitrary shell commands (e.g., via curl, python3, and yt-dlp) as fallback 'L0 tools'. While these features appear aligned with the stated goal of academic research and literature management, the inclusion of active secrets and the reliance on high-risk execution patterns (shell command templates) constitute significant security vulnerabilities and potential vectors for exploitation.