BondInformation

• Analyzed: Apr 3, 2026, 5:46 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3158cd9e7c1c3c1420187efd91bff3f4ffee4a3ad969737ff4487f2df8257b08
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides bond market information via the FEEDAX API but exhibits several high-risk security practices. In SKILL.md, the agent is instructed to execute 'cat .env' to check for configuration, which could inadvertently expose unrelated sensitive secrets stored in the environment file. Additionally, the script 'scripts/query_bond_information.py' transmits the user's API key over an unencrypted HTTP connection to a hardcoded IP address (221.6.15.90:18011), posing a significant risk of credential interception and data exposure.