Dev Machine Database

• Analyzed: Mar 26, 2026, 9:42 AM
• Findings: 1
• Version: 1.0.0
• Hash: 0903cedc2887301e7bc2ffa856dced9d289e932e5966f1505f61eab451c490fb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a Python script (query_db.py) with a critical shell injection vulnerability in the query_mysql_docker function, where SQL strings are directly interpolated into a command string executed via SSH on a remote host (datax). It also includes hardcoded database credentials (root:123456). While these represent significant security risks (Remote Code Execution), they appear to be unintentional flaws in a developer utility rather than intentional malware.