gqllint

• Analyzed: May 10, 2026, 6:33 AM
• Findings: 1
• Version: 1.0.1
• Hash: 549010107c091c70602480038f93b53e9d42acfa02f4236984dbb364d2bc99c8
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains critical command injection vulnerabilities in 'scripts/license.sh' and 'scripts/analyzer.sh'. The 'extract_field' function in 'license.sh' parses JSON by interpolating the raw JWT payload directly into 'python3 -c' and 'node -e' command strings, allowing for remote code execution via a crafted license key. Additionally, 'scripts/dispatcher.sh' modifies local git configurations ('lefthook.yml') to execute scripts from the skill directory. While these behaviors align with the tool's stated purpose as a GraphQL security analyzer and license-restricted product, the lack of input sanitization on externally-influenced data (JWTs and config files) constitutes a high-risk security flaw.