funds-agent

• Analyzed: May 11, 2026, 6:53 AM
• Findings: 1
• Version: 1.0.0
• Hash: b4123bf7cb0702b3ac5b5aa3a8fda0ff660716f574edced3a7a25045bb98918c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a script (fund_daily.py) with hardcoded Telegram Bot credentials and a specific Chat ID ('7333732220'), which would cause financial data to be sent to the author if the user fails to update the configuration as suggested in SKILL.md. Furthermore, the script uses absolute file paths tied to a specific local user environment (C:\Users\ZhuanZ\...) and employs subprocess.run to execute external scripts, which is a high-risk practice. While these appear to be remnants of a personal script rather than a stealthy attack, the combination of hardcoded exfiltration endpoints and broad execution capabilities warrants a suspicious classification.