qutedance-quotes

• Analyzed: May 11, 2026, 7:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: 3e7a18dea2abaebf730c42dc25914d72649465b174368c3bdc5765dafea72e69
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates financial market data retrieval from an external API (quotedance.api.gapgap.cc) and handles authentication via API keys. While the code in scripts/qutedance-quotes.js is functionally aligned with its stated purpose, it is classified as suspicious because it utilizes external network access to a non-standard domain and explicitly encourages the insecure practice of storing API keys in a plain-text configuration file (config.json). These behaviors, while plausibly necessary for the skill's operation, represent risky capabilities and security vulnerabilities in an untrusted bundle.