Museum Data Manager

• Analyzed: May 15, 2026, 7:07 AM
• Findings: 1
• Version: 1.0.0
• Hash: f34dcbebc443ab57b19d280eb0d881a6d443cd60e5455c8b1b928e80a2267055
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill contains significant SQL injection vulnerabilities in museum.py, where user-provided command-line arguments are directly interpolated into SQL strings (e.g., in the list_museums, get_museum, and check_data functions). Additionally, it provides a 'query' command that allows for arbitrary SQL execution. While these capabilities are documented and align with the stated purpose of museum database management, the lack of input sanitization and the broad database access pose a high risk of exploitation, though no evidence of intentional malice or data exfiltration was observed.