Dataview

• Analyzed: May 11, 2026, 7:20 AM
• Findings: 1
• Version: 2.0.0
• Hash: a449042c67923390140fc27f0a5b7ed43f98f57b2e305d63ccdc639ea938d8d4
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a logging utility for data operations that stores entries in ~/.local/share/dataview/. It contains a flag injection vulnerability in the _search function of scripts/script.sh because the $term variable is passed directly to grep, allowing an attacker to provide flags (e.g., -f /etc/passwd) to read unauthorized files. Additionally, the _export function lacks proper output sanitization when generating JSON and CSV files, which can lead to data injection or corruption if the logged values contain quotes or delimiters.