FIND SAP API

• Analyzed: May 11, 2026, 6:30 AM
• Findings: 1
• Version: 1.0.2
• Hash: 3030981692e8406a4f4399c61e7f1c77e9288cc3ced5f3e99d8b2aa707de9779
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains high-risk capabilities including automated browser login via Playwright, system-level file writing, and dynamic Python code generation. Specifically, `reliable_sap_hub_download.py` lacks input sanitization for the `--api-id` parameter, which is directly interpolated into an OData URL, potentially allowing for injection attacks against the SAP Hub API. Additionally, `scaffold_backend_from_openapi.py` generates and writes executable Python code to the `src/` directory based on external OpenAPI specifications. While these features align with the stated purpose of downloading and integrating SAP specs, the combination of credential handling, browser automation, and lack of input validation constitutes a significant security risk.