Lifepath: AI Life Simulator

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 2.0.0
• Hash: 189dd2640c5a1a7c3efd5cb87fb1c82c174ccc93bfa57bc8ab8d92620433497b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to critical security vulnerabilities, primarily the hardcoded Google Gemini API keys found in `src/services/storyGenerator.js` (e.g., AIzaSyCaM-ZhzTYy9ZQoqoR0aw5SdldCmPn6wh8). Additionally, the `INSTALL.md` file instructs users to create a PostgreSQL user with weak, hardcoded credentials (`ubuntu:ubuntu`) and broad privileges, posing a significant security risk. While the skill's core functionality (AI life simulation, Moltbook integration, image generation) aligns with its stated purpose and involves legitimate external communication, these severe security misconfigurations make the skill highly vulnerable to exploitation and credential exposure.