Knowledge Base Skill

• Analyzed: May 18, 2026, 8:43 AM
• Findings: 1
• Version: 2.1.1
• Hash: 14bbcd0105fc11b8102aa4106d9735a4c774b18731b755e7a7418fbb34c2582f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle implements a functional knowledge base with OCR support but contains significant security vulnerabilities. Specifically, `kb-manager.py` is susceptible to path traversal attacks in functions like `delete_business` and `get_business_dir` because the `business_name` parameter is used in `os.path.join` and `shutil.rmtree` without sanitization. Additionally, `kb-image.sh` handles shell arguments and manual JSON construction in a manner that could be exploited if inputs contain shell metacharacters. While these appear to be unintentional implementation flaws rather than intentional malware, they constitute high-risk behaviors that could lead to unauthorized file deletion or command manipulation.