全能订机票国内版-仅支持查询

• Analyzed: May 12, 2026, 3:11 AM
• Findings: 1
• Version: 1.0.0
• Hash: bf979998d6803ade502ceba41d370c090aed8d07f9ef34da0be7af171a8be926
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a flight search interface using the `rollinggo-flight` CLI and the `rollinggo.store` API. It is classified as suspicious due to the promotion of high-risk installation and execution patterns, specifically the use of `curl | sh` and `npx ...@latest` in `SKILL.md` and `references/rollinggo-flight-npx.md`. These practices introduce significant supply chain and remote code execution risks by bypassing version pinning and executing unverified remote scripts. While the behavior appears aligned with the stated purpose and no evidence of intentional malice was found, these patterns are considered high-risk in an automated agent environment.