Deployment Kit

• Analyzed: Mar 27, 2026, 2:46 AM
• Findings: 1
• Version: 0.1.0
• Hash: 41a5b13624bfa4cd9296eda0accb7b4465c6223799350e285a101dd901392658
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle contains a shell injection vulnerability in 'src/deploy-manager.js' where 'child_process.exec' is used with unvalidated configuration parameters (e.g., 'imageName', 'containerName', 'port'). While these capabilities are aligned with the stated purpose of a deployment kit, the lack of input sanitization allows for arbitrary command execution. Additionally, the code uses Windows-specific shell syntax ('findstr', '2>nul') which may cause unexpected behavior or errors on non-Windows systems.