Istore Build Passwall

• Analyzed: May 8, 2026, 1:31 AM
• Findings: 1
• Version: 1.0.4
• Hash: 20766d70b1f208364e25cafd9ef95b7265c1c34ee6ed2723b2f88b9cd3efe7f2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle requests a high-privilege GitHub Personal Access Token (PAT) and uses it to perform a destructive 'git push --force' in SKILL.md, which can overwrite the user's repository content. It also programmatically modifies repository settings to grant write permissions to GitHub Actions. The included workflow (build-passwall.yml) fetches binaries from a third-party SourceForge project (openwrt-passwall-build) and packages them into a self-extracting .run script for execution on a router, presenting a significant supply chain risk without clear evidence of malicious intent.