dev-security-audit

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 1.00). These links include an archived Apifox CDN JavaScript that was poisoned (a direct malicious payload used for RCE) and a GitHub Gist with partial deobfuscated malicious JS — known artifacts from the Apifox supply‑chain compromise and therefore suspicious as malware distribution sources.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The repository contains detailed, explicit descriptions and IoCs for active supply-chain malware (Apifox and Axios) including Node.js RCE loaders, staged exfiltration endpoints, hardcoded C2 servers, postinstall RAT droppers, and a persistent reverse-tunnel backdoor — all clear indicators of deliberate malicious activity.

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill explicitly enumerates crypto wallet files/paths (Solana, Electrum, OneKey, Ledger Live, Tonkeeper) and instructs actions that operate on blockchain assets: "For plaintext keys (Solana), immediately check balance via RPC" and guidance to "transfer if needed" for compromised wallets. These are wallet-specific, asset-management instructions (interacting with RPCs and moving funds), which constitute direct crypto/financial execution capability rather than a generic scan.