OpenGemini SaaS Builder

• Analyzed: Mar 31, 2026, 1:36 AM
• Findings: 1
• Version: 1.0.0
• Hash: 28b6c9785ac5a9bc4f220791fb18d1de8d29b9520e39b503afd49c91d388b181
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains shell injection vulnerabilities in several helper scripts, including generate_architecture.sh, generate_requirements.sh, and generate_rules.sh. These scripts embed unsanitized variables ($project and $brief) directly into shell command strings passed to the gemini CLI, which could lead to arbitrary command execution if the agent processes malicious user input. While the SKILL.md instructions include safety guidelines and require user approval for external actions like GitHub repo creation and Vercel deployment, the lack of input validation in the underlying shell scripts represents a significant security flaw.