Cubox Integration (International & China)

• Analyzed: May 12, 2026, 3:33 AM
• Findings: 1
• Version: 1.0.0
• Hash: b9acd6c18023968edd000ceb50cb9b25d3e14c5ecba70f3d444d4dc37562051f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to integrate with the Cubox API to save URLs and memos. The `SKILL.md` clearly outlines the purpose and prerequisites, including setting a `CUBOX_API_URL` environment variable, which is explicitly warned as a credential. The Python scripts (`save_memo.py`, `save_url.py`) correctly retrieve this API URL from the environment and make `requests.post` calls to it, sending user-provided content. There is no evidence of data exfiltration beyond the intended Cubox API, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. All actions are aligned with the stated purpose of saving content to Cubox.