Li ETL Handle

• Analyzed: May 11, 2026, 7:19 AM
• Findings: 1
• Version: 1.0.1
• Hash: c9d39f14b995c1a63c7908893a3d50da70ce28cf2443acfa7ba4954a5331e188
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides a comprehensive ETL toolkit for Excel and CSV processing but includes a high-risk `executeScript` function in `index.js` that allows for arbitrary JavaScript execution on data. It also relies on `xlsx@0.18.5`, a version with known high-severity vulnerabilities (Prototype Pollution and ReDoS), which the author acknowledges in the included `SECURITY_AUDIT.md` and `SECURITY_FIXES.md`. While the developer is transparent about these risks and provides extensive documentation and testing, the inherent risk of the script execution feature and the vulnerable dependency meet the criteria for a suspicious classification.