OpenKM Document Management

• Analyzed: May 12, 2026, 3:34 AM
• Findings: 1
• Version: 1.0.1
• Hash: 613365da835e6fe3d265f3084b57e7d7932606a7d304949e0c77e23bb42cef6d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a Python CLI client for OpenKM, designed to interact with the OpenKM REST API for document management. It requires `OPENKM_BASE_URL`, `OPENKM_USERNAME`, and `OPENKM_PASSWORD` environment variables for authentication, which are used appropriately for HTTP Basic Auth. The `SKILL.md` explicitly states the agent uses 'shell calls' to `openkm_cli.py`, which is a high-risk capability, but the Python script itself only performs HTTP requests to the specified OpenKM instance and local file I/O for uploads/downloads, without executing arbitrary shell commands or exfiltrating unrelated data. All actions are aligned with the stated purpose of OpenKM integration, and there is no evidence of prompt injection, obfuscation, or other malicious intent.