database-admin

• Analyzed: May 15, 2026, 6:59 AM
• Findings: 1
• Version: 2.0.0
• Hash: dd509e29e4f7f0a94645d6f03ce35862ae5179ab9b30cf2fcd064042e2a4d288
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains hardcoded database credentials (IP 192.168.1.136, user 'postgres', password 'Hxkj510510') and scripts specifically targeting sensitive HR, payroll, and attendance data (query_kaoqin_forms.js). Additionally, almost all utility scripts, including create_table.js, query_helper.js, and schema_migrate.js, contain critical SQL injection vulnerabilities due to direct string concatenation of parameters into SQL queries. While these functions are consistent with the stated 'Database Admin' purpose, the combination of exposed credentials and lack of input sanitization poses a high risk of unauthorized data access or manipulation.