PingCode

• Analyzed: May 14, 2026, 11:56 AM
• Findings: 1
• Version: 1.2.2
• Hash: 391da45436d18edd01eab396468258ed1d8c1072d93fcd3aeeb21ee1d6ad321e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a hardcoded public IP address (45.251.20.42) and active API credentials in 'config.json', rather than using placeholders or the official PingCode cloud endpoint. This is highly suspicious as the 'SKILL.md' instructions encourage users to configure the tool by providing their own sensitive 'client_id' and 'client_secret' via the agent; if a user provides these without also changing the 'base_url', their credentials and project data would be transmitted to this unknown external server. While the Python scripts (e.g., 'get_projects.py', 'update_workitem.py') appear to be functional API wrappers, the default configuration poses a significant risk of credential harvesting or unauthorized data exfiltration.