Hybrid DB Health

• Analyzed: May 11, 2026, 5:01 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6903e224d9d61b3a2a9573b9ebe53a5281637e1eeee1577a778a498a9ac3787b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the `scripts/check_hybrid_db.sh` file directly reading and parsing `OPENAI_API_KEY` and `PINECONE_API_KEY` from a local `.env` file. While the script does not explicitly exfiltrate these keys in its final output, the act of extracting sensitive credentials into shell variables for internal processing represents a high-risk capability. This could be a vulnerability if the script were modified or if the `query.py` script it calls were to log or expose these details, even if not intentionally malicious in its current form.