金蝶ERP销售订单执行情况查询

• Analyzed: May 12, 2026, 6:06 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5ccb05ad7e91f1b015d377c93cd797195a0306449e1393530cc63fab5686a448
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains hardcoded plaintext database credentials (host, port, username, and password) for a public IP address (111.198.79.26) within both SKILL.md and scripts/kingdee_query.py. While the script logic is functional and uses parameterized queries to prevent SQL injection, the exposure of sensitive credentials for a remote production-style database is a significant security risk and a major vulnerability.