Url Reader

• Analyzed: May 12, 2026, 3:54 AM
• Findings: 1
• Version: 0.1.1
• Hash: 4bc02ebda103d4872b87d6c6bbc77f5e27b7c2af59144c98d9b226a7b5454b5a
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed to read and save content from arbitrary URLs, which inherently involves network requests and local file system writes. It is classified as 'suspicious' due to several vulnerabilities rather than clear malicious intent. Key indicators include a hardcoded output directory (`/Users/ys/laoyang知识库/nickys/素材`) in `skill.md`, `scripts/save_content.py`, and `scripts/url_reader.py`, which could lead to unintended file writes. Furthermore, `scripts/save_content.py` and `scripts/url_reader.py` download images from arbitrary URLs and save them to disk without robust content validation, posing a risk of downloading malicious files. The use of Playwright's `page.evaluate()` in `scripts/url_reader.py`, `scripts/wechat_reader.py`, and `scripts/wechat_reader_v2.py` to execute JavaScript in a browser context could also be vulnerable to client-side injection if a malicious URL is processed. While these are significant risks, there is no evidence of intentional data exfiltration, backdoor installation, or harmful prompt injection.