jeecg-onlchart

SUSPICIOUS. The core Jeecg chart-automation purpose aligns with the JeecgBoot and YApi endpoints it uses, and there is no remote installer or obvious malware payload. However, the skill asks the agent to collect browser tokens, optionally collect YApi credentials, send them to user-chosen endpoints, disable TLS verification in example code, and optionally execute local MySQL writes with default root credentials. These are meaningful security risks even though the overall workflow is coherent with the stated purpose.

The code does not show clear malicious or supply-chain behavior. It is an administrative API wrapper for JeecgBoot chart management and publication. The significant security issue is that TLS certificate and hostname verification are disabled, allowing man-in-the-middle interception of the X-Access-Token and API data. The module also performs high-impact permission changes when explicitly invoked and forwards caller-supplied SQL and extension JavaScript to the backend. Use only with trusted API bases and restore normal TLS verification.

The code appears to be a YApi mock-management utility rather than malware. It performs authenticated CRUD operations against a hardcoded YApi service and does not show data theft, reverse shells, cryptomining, persistence, or arbitrary code execution. However, disabling TLS certificate verification is a significant transport-security vulnerability and could expose login credentials and session data to a man-in-the-middle attacker. The provided fragment also cannot run as written because of an unterminated string in the final usage output.

This is a feature-use guide, not malicious executable code. It presents no evidence of malware or intentional sabotage. However, it promotes transmitting a live browser token to an AI workflow and describes dynamic SQL and custom JavaScript capabilities without showing enforcement controls. Token exposure and SQL injection should be reviewed in the actual skill implementation and JeecgBoot backend; credentials should be scoped, redacted, and never unnecessarily shared.