nokey-vehicle-info

• Analyzed: Mar 24, 2026, 9:16 AM
• Findings: 1
• Version: 1.0.2
• Hash: 2fde034f19b2f7bcb85693a6e4301c276f4bbeaeafe123231e1a826c981677a2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill manages vehicle information by executing shell commands (curl, jq, awk) to interact with third-party APIs (ingeek.com, nokeeu.com). It requests sensitive authentication tokens from the user and stores them in plaintext in a local cache file (~/.nokey_vehicle_info_cache.json), which is a significant security vulnerability. Additionally, the instructions in SKILL.md for processing user-provided tokens via shell scripts are potentially vulnerable to shell injection if the AI agent does not sanitize the input before execution. While these capabilities are plausibly needed for the stated purpose, the combination of risky shell execution and insecure credential handling warrants a suspicious classification.