查找资料

• Analyzed: May 11, 2026, 6:22 AM
• Findings: 1
• Version: 1.0.1
• Hash: ea99a59afdcb3952bde7bb790b321c35010c4390ec83d58693e375c7159f0dea
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle defines a search tool that communicates with an external API over unencrypted HTTP using a raw IP address (36.151.144.35:3001) and includes a hardcoded API key (sk_test_a6f84bf78896f10b2d28aebd7857744c) in SKILL.md. While the functionality aligns with its stated purpose of web and news searching, the lack of transport encryption and the presence of hardcoded credentials represent significant security vulnerabilities that could lead to credential theft or data interception.