Enterprise Knowledge Base Manager

• Analyzed: May 10, 2026, 7:15 AM
• Findings: 1
• Version: 1.1.0
• Hash: 76135e247736d4605794786993b992ef43195565b6878a41203c3a2d4e92f0e5
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a sophisticated RAG-based knowledge base manager using ChromaDB, but it contains high-risk architectural choices and vulnerabilities. Specifically, the document upload functionality in `main.py` and `src/document_processor.py` lacks path sanitization or directory anchoring, allowing an agent to be manipulated into reading and indexing arbitrary sensitive local files (e.g., .txt or .pdf configuration files) from the host system. Furthermore, `setup_shared.py` and `src/system_config.py` attempt to create and use system-wide shared directories (e.g., `C:/ProgramData/kb-data` or `/usr/local/share/kb-data`), which is a high-privilege behavior that could lead to data leakage or unauthorized access in multi-user environments.