Near Multi Account Manager

• Analyzed: May 12, 2026, 3:37 AM
• Findings: 1
• Version: 1.0.2
• Hash: 81249e013ec83ef5029f314a54bf5081d4363ccdc91bdae756b7d9ce37962655
• Source: palm
• External report: View on VirusTotal

Findings (1)

The core skill functionality for NEAR multi-account management appears benign. However, the bundle includes several ancillary JavaScript files (e.g., `check_deliverable_endpoint.js`, `check_job.js`, `submit_deliverable.js`, `submit_deliverable_submit.js`, `update_deliverable.js`) that contain a hardcoded live API key (`sk_live_iOQS6NKYgLCf8sAcIsjeNpIvsN9ml7fK6CVrfIyPIVs`) and make network requests to an external domain (`market.near.ai`). While these scripts are likely for developer-side job submission/testing and not intended to harm the end-user, the inclusion of a live secret key and external network communication outside the skill's stated purpose is a significant security oversight and a risky capability.