机票助手

• Analyzed: Mar 30, 2026, 11:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: 4e537cd17bb62cd6e280c525633ebf5963a45ec97f7442d5cfd1ba075c80a45d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for flight booking and handles highly sensitive Personal Identifiable Information (PII), including passenger names, phone numbers, and national ID card numbers. A significant security vulnerability exists in `scripts/common.py`, where SSL certificate verification is explicitly disabled using `ssl._create_unverified_context()`, exposing sensitive data to Man-in-the-Middle (MITM) attacks during transmission to `app-gate.fenbeitong.com`. Additionally, authentication tokens are stored in a shared temporary directory without explicit restrictive file permissions, potentially leaking credentials to other local users. While these appear to be critical security flaws rather than intentional malice, the combination of PII handling and weakened transport security warrants a suspicious classification.