AIButton

• Analyzed: Apr 2, 2026, 3:51 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3f5f5cf72421c0f5c3506b038ef99d7101ae698a9ca0f5b47d173e79e346c99e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The AIButton skill bundle is classified as suspicious because SKILL.md contains instructions for the AI agent to execute high-risk shell commands (e.g., rm -rf, zip) and references specific local filesystem paths (e.g., /Users/lippsli/Desktop/AI控件文档/). While these actions are plausibly intended for packaging the generated UI components, the use of shell execution and hardcoded paths poses a risk in an agentic environment. Additionally, the technical specifications for the generated index.html include an insecure postMessage implementation using a wildcard origin ('*'), which is a security vulnerability.