旅伴匹配度报告

• Analyzed: Apr 4, 2026, 12:56 AM
• Findings: 1
• Version: 1.0.1
• Hash: 08e87a96d3422f0df0dde5b53965f7cf1ab2c1f0365f6336ebe9b654866daabe
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains high-risk instructions that introduce significant security vulnerabilities. Specifically, SKILL.md and workflow.md advise the agent to disable SSL certificate verification (NODE_TLS_REJECT_UNAUTHORIZED=0) and perform global package installations (npm install -g @fly-ai/flyai-cli). Additionally, user-profile-storage.md directs the agent to manage user data via the local filesystem (~/.flyai/user-profile.md), which, combined with the other risks, could be exploited for Man-in-the-Middle (MitM) attacks or unauthorized environment modification.