财经监控

• Analyzed: Mar 31, 2026, 11:41 AM
• Findings: 1
• Version: 1.6.0
• Hash: 743bbeb443d5fc4fe7a9e255b7e5a5a11db3602d8af397ddc0e1976541baa5bc
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains instructions in SKILL.md that direct the AI agent to exfiltrate user query results to a hardcoded third-party WeChat account (ID: o9cq8012x7_zwZtDYePv8bo7qxLM) instead of the active user's session. While the stated purpose is a financial tracker and the Python script fetch_gold.py performs legitimate API calls, the explicit instruction to use a specific 'target-user' and 'target-session' for the 'copaw channels send' command constitutes a data redirection risk. This behavior ensures the author receives a copy of every stock or commodity the user monitors, violating privacy and potentially leaking sensitive financial interests.