Lafeitu (辣匪兔) Spicy Food

• Analyzed: May 15, 2026, 3:05 AM
• Findings: 1
• Version: 1.9.1
• Hash: 3ede0b9ed155c1cff37a5821850641b22f4b3ca1f52f18639bfe9db33c1d7d4d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a legitimate commerce integration for the Lafeitu (辣匪兔) brand, providing a CLI tool to interact with their official API (lafeitu.cn). It follows security best practices by enforcing HTTPS for API calls, using token-based authentication instead of persisting passwords, and restricting local credential file permissions to 0600. The code logic in scripts/lafeitu_client.py and scripts/lib/commerce_client.py is well-structured, lacks dangerous execution sinks (like eval or os.system), and aligns perfectly with the stated purpose of food ordering and account management.