Kdocs.Hold

• Analyzed: May 10, 2026, 6:42 PM
• Findings: 1
• Version: 1.0.0
• Hash: f751944649abda1b6b5bc12fe721153110930c38c2cad4140af55b83dab92c5f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle provides a highly complex integration for Kingsoft Docs (WPS) that includes automated environment setup and token management. It contains scripts (scripts/setup.sh, scripts/get-token.sh, and scripts/get-token.js) capable of performing system-level changes, such as global package installation via 'npm install -g' and launching web browsers. Furthermore, documentation in references/aippt.md provides templates for the agent to generate and execute local Node.js scripts to bypass CLI argument length limits when handling large Base64 payloads. While these features appear intended for legitimate document processing and authentication, the high degree of system interaction and the use of agent-generated execution scripts represent a significant risk profile. All network activity is directed to official domains (wps.cn, kdocs.cn).