极限出发

• Analyzed: Apr 3, 2026, 10:21 PM
• Findings: 1
• Version: 1.0.1
• Hash: 979dbce5b4e4c02c0cd30aa6a220d593eeaee720d8366be9304f6e6c4be8565b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains high-risk instructions in 'reference/workflow.md', specifically requiring the AI agent to perform a global NPM package installation and systematically disable SSL certificate validation using the 'NODE_TLS_REJECT_UNAUTHORIZED=0' environment variable. These instructions introduce severe security vulnerabilities, such as susceptibility to Man-in-the-Middle (MitM) attacks and unauthorized system-wide software modifications. Additionally, the skill implements a persistence mechanism by reading and writing user data to the local filesystem at '~/.flyai/user-profile.md' (reference/user-profile-storage.md), which involves direct filesystem access beyond standard agent memory.