건강보험심사평가원 병원 검색

• Analyzed: May 11, 2026, 4:34 AM
• Findings: 1
• Version: 3.2.0
• Hash: f2710b0964fb48e589b5649aae340e2daebecea4f5a4e6967cafc2f9494407a6
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to a critical shell injection vulnerability found in `scripts/hospital_search.sh`. The `HOSP_NAME` parameter is directly interpolated into a single-quoted Python string within a `python3 -c` command without proper escaping, allowing an attacker to inject arbitrary shell commands by crafting a malicious `HOSP_NAME` value. This constitutes a Remote Code Execution (RCE) vulnerability. Other files are largely benign, though `scripts/hospital.sh` contains a functional bug where a shell variable is not expanded within an embedded Python script.