本月轻松旅行盲盒

• Analyzed: Apr 3, 2026, 2:36 AM
• Findings: 1
• Version: 1.0.0
• Hash: af95a21aacfd1847c0865fcd1aec7f3296947c39b17d3f3ef609140c9b71f6c2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill instructions in SKILL.md direct the AI agent to perform high-risk system operations, specifically checking for and globally installing a Node.js package (`npm install -g @fly-ai/flyai-cli`) and executing shell commands like `date` and `which`. While these actions are contextually relevant to the travel-planning functionality, the instruction for an agent to self-install global dependencies—including a suggestion to use `sudo`—poses a significant security risk for unauthorized system modification and potential supply chain exploitation.