蒋道理｜撤三证据链与风险审核引擎（SJ-IRAC）

• Analyzed: May 12, 2026, 3:20 AM
• Findings: 1
• Version: 3.0.1
• Hash: 8b7a85fb26f3bdfef818464e98a6e11235389d36a650003cf861272d0472338b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to its extensive use of `subprocess.run` to execute external binaries (`pdftoppm`, `tesseract`, `soffice`) and other Python scripts, as well as the presence of local web and desktop UIs that expose HTTP servers and interact with the file system. While these capabilities are central to the stated purpose of document processing and report generation, they introduce a significant attack surface for potential vulnerabilities (e.g., RCE risks, local privilege escalation, or misconfiguration leading to unauthorized access). There is no clear evidence of intentional malicious behavior such as data exfiltration or backdoors; in fact, the `AGENTS.md` documentation and `utils/logger.py` indicate a focus on security best practices and sensitive data sanitization. However, the inherent risks associated with these powerful system interaction features, even when plausibly justified, warrant a 'suspicious' classification rather than 'benign'.