HK3 CRM 安装器

• Analyzed: May 11, 2026, 11:16 AM
• Findings: 1
• Version: 1.0.1
• Hash: 311a150993f96d5c6f06da13c24e75ba0cf6da7d97edfd6611c892c99d4a77a2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill functions as an installer that clones a remote GitHub repository (https://github.com/jiangyisheng9-bot/hk3-crm.git) and executes its contents. The setup.sh script installs unverified Python dependencies and launches a background process (app.py) using nohup, which constitutes a remote code execution risk. While the stated purpose is a CRM installation, the reliance on an external, unverified repository to fetch and run code is a significant security concern.