Lead Processor

• Analyzed: May 11, 2026, 4:52 AM
• Findings: 1
• Version: 1.0.2
• Hash: 4724248a67e6f41c0a70f7834e3c9c8321522f73cf196b25e61a0015a0998012
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the presence of hardcoded default Feishu API credentials (`FEISHU_APP_ID`, `FEISHU_APP_SECRET`) within `index.js` and `lead-processor/index.js`. While these can be overridden by environment variables, their inclusion as defaults in the source code represents a minor information security vulnerability. Additionally, the `SKILL.md` instructs the AI agent to use a 'browser tool' to visit external customer websites for 'deep analysis', which, while necessary for the skill's stated purpose, involves a powerful capability that could be exploited if the agent's browsing environment is not adequately sandboxed. The duplication of several files (e.g., `index.js`, `config.json`, `SKILL.md`) in the root and a subdirectory is also an unusual packaging choice, though their content is identical and not malicious.