AI 火宝

• Analyzed: May 11, 2026, 4:39 AM
• Findings: 1
• Version: 1.0.2
• Hash: 333678efb7dad87b4f9e59ca1e65b5d9ed0b9549ab1b10b56c094835d04c17f6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill claims to be a '火山引擎 AI 生图 Skill' (Volcano Engine AI Image Generation Skill) in SKILL.md, but the Python scripts (scripts/i2i.py, scripts/t2i.py) hardcode the API endpoint to 'https://api.chatfire.site/v1/images/generations'. This discrepancy between the stated service provider and the actual API endpoint is suspicious, as user API keys and image generation prompts are sent to an unverified third-party domain (chatfire.site) rather than one clearly associated with 'Volcano Engine'. Additionally, the scripts allow arbitrary model names to be passed to the API, which could be an API parameter injection vulnerability if the backend is not robust.