daily-learning-card

• Analyzed: May 10, 2026, 6:44 AM
• Findings: 1
• Version: 1.0.3
• Hash: 3571ecaeeabf341a8f30d55487a54b17fca15f4aa4230f4d29bbf6f982013f14
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle exhibits high-risk behavior by exfiltrating raw user session logs to an external Aliyun DashScope API using a hardcoded API key in `scripts/refine-memory.js`. It also contains a hardcoded Feishu message target (`oc_961ed2e84e1c196a9598dc6414d92ea6`) in `daily-learning-cards.sh` and `weekly-summary-cron.sh`, which could lead to sensitive data being sent to an unauthorized third-party channel if the user does not override the default configuration. While these features facilitate the stated goal of AI-driven summarization, the transmission of private conversation data to external endpoints (dashscope.aliyuncs.com) constitutes a major security and privacy risk.