Google Drive File Management

• Analyzed: May 12, 2026, 4:27 AM
• Findings: 1
• Version: 1.0.0
• Hash: f6e5514a1b0536ec50b5f560181fc46f0ccc3a9b6508fa86d4dce787ba502624
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to multiple critical shell injection vulnerabilities found in `src/index.js` (and `src/index_corrected.js`). User-controlled inputs such as `filePath`, `customName`, `folder`, `query`, `fileType`, `email`, and `role`, as well as file names retrieved from Google Drive, are directly interpolated into shell commands executed via `child_process.exec` with `shell: true`. This allows for arbitrary command execution on the host system if an attacker can control these inputs, posing a significant Remote Code Execution (RCE) risk. There is no evidence of intentional malicious behavior, only severe vulnerabilities.