siigo-pyme-excel

SUSPICIOUS. The skill’s purpose and capabilities are mostly coherent for local SIIGO Pyme Excel automation, and data flows stay local rather than exfiltrating to third parties. However, it relies on a proprietary unverifiable executable and forwards credentials to it, which creates a mandatory high supply-chain/security concern even without clear malicious intent; destructive PUSH operations further raise operational risk.

No evidence in this bash fragment of intentional malware (no exfiltration, persistence, or overt malicious payload behavior). However, the wrapper has a notable security risk: it generates and executes a temporary Windows .bat file using cmd.exe, with the .bat contents assembled from untrusted CLI/environment inputs. The quoting logic only handles embedded double-quotes and does not generally neutralize Windows cmd/batch metacharacters or control characters, which can enable command-injection or unintended command interpretation in edge cases. Separately, SIIGO_USUARIO/SIIGO_CLAVE are passed as command-line arguments, increasing the chance of credential leakage via process inspection and error/log output. Treat this wrapper as higher-than-normal risk and require strict input handling/validation and least-privilege execution.