myskill

• Analyzed: May 10, 2026, 6:30 AM
• Findings: 1
• Version: 1.0.0
• Hash: fdaa7c017cc7daa42dea03f58e24c05cbb7512f287e327d93ac6cacbcc19a645
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains scripts for scraping Douyin trends but includes a hardcoded Telegram chat ID ('8428610733') in 'cron-job.js' and 'daily-hot-trend-output.json', which could result in data being sent to a third party if used with automated messaging tools. Additionally, 'cron-job.js' and 'scripts/get-hot-trend.js' utilize 'execSync' to execute internal shell commands; while not explicitly malicious in this context, this pattern is a common vector for command injection if inputs are not strictly controlled.