酒店三选一

• Analyzed: Apr 3, 2026, 6:46 PM
• Findings: 1
• Version: 1.0.1
• Hash: ab93fef259657efc74e221a0e8a6e0592e85654bc9dcadfad33a797d58024bac
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle instructs the AI agent to perform high-risk system operations, including a global NPM package installation (`npm install -g @fly-ai/flyai-cli`) and the explicit disabling of SSL certificate validation (`NODE_TLS_REJECT_UNAUTHORIZED=0`) in SKILL.md. While these appear to be functional requirements for the 'FlyAI' service, bypassing SSL security is a critical vulnerability that exposes the agent to Man-in-the-Middle (MitM) attacks. Additionally, the skill implements local file persistence in `~/.flyai/user-profile.md`, which, combined with the shell execution requirements, represents a significant security risk even if no direct malicious intent is proven.