药撮合品种综合查询

• Analyzed: May 10, 2026, 6:44 AM
• Findings: 1
• Version: 2.3.0
• Hash: 6475184c0383150f0f4bf714ec2ea6ad68f1847543257c008d9d6299df474a5f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides pharmaceutical data retrieval services by connecting to an external MCP server and hosting its own installation ZIP files on a raw IP address (120.53.229.6) via unencrypted HTTP. While the instructions in SKILL.md and tool definitions in skill.json are functionally aligned with the stated purpose and include safety constraints against medical hallucinations, the reliance on insecure infrastructure for both service execution and software distribution represents a significant security vulnerability and a risk for man-in-the-middle attacks.