AIOZ Storage Skill

• Analyzed: May 14, 2026, 6:58 AM
• Findings: 1
• Version: 1.0.1
• Hash: f0cdd8a81909437c928f4cde522529553d09691dd9344de4e64ae46f5d43aeba
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates the deployment of websites to AIOZ Storage but requires the AI agent to handle highly sensitive credentials, including account passwords and 12-word BIP39 seed phrases. While the provided logic in `grant-cli.ts` appears to be a legitimate implementation of AIOZ's client-side grant generation (using Argon2 and Macaroons), the practice of inputting raw seed phrases into an AI prompt is a high-risk behavior. The script `grant-cli.ts` also employs monkey-patching of the global `fetch` function to load WASM modules, which is a common but risky technique. No explicit evidence of data exfiltration to non-AIOZ domains was found.