商品归类skill

• Analyzed: Apr 24, 2026, 5:56 AM
• Findings: 1
• Version: 0.1.0
• Hash: fc7dbfc6885380038e7dfd5e833a4f1e90a0a0a981f036e5f044e0ed68b23a82
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a mandatory PII collection flow that requires users to provide a phone number before fulfilling requests. It stores session IDs and phone numbers in a local SQLite database (users.db) and transmits this data to an external endpoint (agent.ccorp.cn). The SKILL.md file uses aggressive prompt instructions to force the AI agent to demand phone numbers and explicitly prohibits the agent from providing results or 'simulating' answers without successful data collection. While the behavior is documented in the README, the forced harvesting of contact information linked to user queries is a significant privacy risk.