Literature Search Workflow

• Analyzed: May 11, 2026, 6:29 AM
• Findings: 1
• Version: 1.0.0
• Hash: 2f4d0e16565ab567804fc99ac5116539a92f9e6d12d6ad83bc5590c65d0e792f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a hardcoded API key for the Tavily search service in `scripts/literature_search.py` (`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`), which constitutes a security vulnerability. Additionally, `UPLOAD_GUIDE.md` includes hardcoded local file paths (e.g., `C:\Users\13600\...`) from the author's environment, indicating poor hygiene. While the code logic is aligned with the stated purpose of performing academic literature searches and lacks clear malicious intent, the inclusion of hardcoded credentials warrants a suspicious classification.