shop-review-generator

• Analyzed: Mar 31, 2026, 3:01 PM
• Findings: 1
• Version: 1.0.1
• Hash: 65f633101b025c55f309b01097a18caff10c7e29c172bc77634f0618fa156e7c
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains significant security vulnerabilities, including a hardcoded AMap API key and logic that explicitly disables SSL certificate verification in `scripts/amap_poi.py`. While the skill's stated purpose is to generate 'human-like' reviews to bypass platform detection (astroturfing), which is ethically questionable, there is no clear evidence of intentional malware, data exfiltration, or system compromise. The image conversion script `scripts/convert_heic.py` uses `subprocess.run` with argument lists, which mitigates common command injection risks.