Auto Contents

• Analyzed: Apr 3, 2026, 1:21 PM
• Findings: 1
• Version: 1.0.0
• Hash: dcebce5260ef0819a3f1882f81dee92942649809439332beb85b1f32df994ac0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle instructs the AI agent to use high-risk execution methods, specifically 'exec' combined with 'curl', to interact with a local API service (http://localhost:3710). While these capabilities are aligned with the stated purpose of automating RSS news aggregation and social media publishing (WeChat, Feishu, Xiaohongshu), granting an agent shell-level execution access is a significant security risk. There is no evidence of intentional malice, such as data exfiltration or backdoors, but the architectural pattern in SKILL.md and references/api.md relies on a broad attack surface that could be exploited via prompt injection.