VPS Agent Migration

• Analyzed: May 15, 2026, 4:59 AM
• Findings: 1
• Version: 1.0.0
• Hash: a71a12e7ae4c9de100ba5e105fc104fb03bec61bd91ae42f66d61d4064749b67
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to multiple severe vulnerabilities, primarily a critical Remote Code Execution (RCE) risk in `SKILL.md` (Step 3). The Python script executed on the remote VPS directly interpolates the `[Token]` placeholder into a string that is then executed, allowing for arbitrary Python code injection if a malicious token is provided. Additionally, the skill uses `sshpass` with plaintext passwords and disables `StrictHostKeyChecking`, exposing credentials and enabling potential Man-in-the-Middle attacks. Various other placeholders (`[agent名]`, `[Discord_ID]`, `[agentId]`) are directly inserted into shell commands without apparent sanitization, creating further shell injection vulnerabilities on both local and remote systems.