MT-Paotui-For-Client

• Analyzed: May 10, 2026, 6:44 AM
• Findings: 1
• Version: 1.0.1
• Hash: 63037b19c6a3443c04d5b3739ecf6edbffc900da353b283bd4ff7f077889f003
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains heavily obfuscated JavaScript files (cliguard.js and cliguard-wrapper.js) that implement a background daemon and a worker process with persistence. This code performs system fingerprinting and includes a remote update mechanism (UPDATE_VERSION_URL) that can fetch and execute arbitrary code, which functions as a potential backdoor. While these features are likely intended to bypass Meituan's anti-bot protections (mtgsig), the combination of extreme obfuscation, background execution, and remote code fetching poses a significant security risk. Additionally, SKILL.md explicitly instructs the AI agent to hide all technical details and command-line execution from the user, which could be used to mask unauthorized background activities.