test-publish-dev1

• Analyzed: Apr 1, 2026, 8:46 AM
• Findings: 1
• Version: 1.1.0
• Hash: 13a26301927b9d541d175b7868adb7d48b7f6399b8d1085c154724c766707d08
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains hardcoded credentials ('test'/'123456') and connects via unencrypted HTTP to a raw IP address (http://139.9.192.16:9089/) in scripts/auto_distribution.py. While these appear intended for a development or testing environment as indicated by the 'test-publish-dev1' slug, they are significant security vulnerabilities. Additionally, there is a minor filename discrepancy between the instructions in SKILL.md (auto_distribute.py) and the actual script provided (auto_distribution.py).