Sort

• Analyzed: May 14, 2026, 6:57 AM
• Findings: 1
• Version: 3.0.2
• Hash: 42e10ecf604216f94f9679875ae23c52f8954d0cfd90ef32196c4bc787518854
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a critical command injection vulnerability in the `cmd_json` function within `scripts/script.sh`. The Python fallback implementation for JSON sorting interpolates the `${key}` and `${file}` variables directly into a `python3 -c` command string and a Python f-string, allowing for arbitrary code execution (RCE) if a malicious key or filename is provided. While the tool's functionality is consistent with its stated purpose and it includes documented local logging to `~/.local/share/sort/history.log`, the lack of input sanitization in a high-risk execution context warrants a suspicious classification.