Filtalgo Shopping

• Analyzed: May 13, 2026, 4:16 PM
• Findings: 1
• Version: 0.2.1
• Hash: dadd61ce7fef3127dfdc561753be9e6b8745abb6034057a97a79f8a71923466d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a shopping CLI for the Filtalgo platform but contains significant security vulnerabilities. Specifically, the bundled code in 'assets/filtalgo-cli.cjs' (within modules 'auth.js' and 'api.js') explicitly disables SSL certificate validation by setting 'rejectUnauthorized: false', which exposes users to man-in-the-middle attacks. Additionally, an OAuth client secret is hardcoded in 'config.js'. While these flaws are high-risk, they appear to be unintentional development oversights rather than intentional malware, as the tool's behavior remains consistent with its stated purpose of managing shopping flows and orders.