Li Python Sec Check

• Outcome: Review
• Latest audit: May 28, 2026 · 7:38 AM UTC
• Version: 0.0.2

Overview

This is a disclosed local Python security-checking skill with optional LLM analysis, but users should avoid running the intentionally unsafe example app as a server.

Before installing, understand that the scanner will read the target project and write reports locally. Do not run examples/unsafe-example/app.py or expose it on a network. Avoid LLM analysis for private code unless you are comfortable sending snippets or scan results to the configured API endpoint, and prefer environment variables or a secret manager over command-line API keys.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

os.system() or os exec-family call

High

• Category: Dangerous Code Execution

Content

@app.route('/ping')
def ping():
    host = request.args.get('host', 'localhost')
    os.system("ping -c 1 " + host)

# ❌ eval 注入
@app.route('/calc')

• Confidence: 99% confidence
• Finding: The /ping route concatenates untrusted user input into a shell command and executes it with os.system(), creating a classic command injection vulnerability. In this file's context, the code is explicitly presented as intentionally unsafe example code, which lowers the likelihood of malicious intent but not the technical severity if the example is run as a real Flask service.

eval() call detected

High

• Category: Dangerous Code Execution

Content

@app.route('/calc')
def calc():
    expr = request.args.get('expr', '1+1')
    return str(eval(expr))

if __name__ == '__main__':
    # ❌ 调试模式开启

• Confidence: 99% confidence
• Finding: The /calc route evaluates attacker-controlled input with eval(), which can lead to arbitrary Python code execution on the server. Because the file is a runnable Flask app exposed on 0.0.0.0 in debug mode, this becomes especially dangerous if anyone launches the example outside a controlled environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill metadata declares no permissions, yet the analyzer detected capabilities for environment access, file read/write, network, and shell execution. This mismatch is dangerous because it hides the skill's effective trust requirements from users and reviewers, increasing the chance that a powerful skill is installed or run without informed consent or appropriate sandboxing.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: This file implements a network-accessible Flask application with command execution and dynamic evaluation features, which is inconsistent with the advertised purpose of a security checking tool. The mismatch increases risk because users may treat the repository as defensive tooling while it contains directly runnable offensive or unsafe behavior.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: The combination of HTTP exposure plus system command execution and dynamic code evaluation is far more dangerous than expected for a security checker utility. In skill context, capability-purpose mismatch matters because users may install or run the skill trusting its stated defensive function, increasing the chance of unsafe deployment.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The file states it is only an unsafe test example, but it is fully runnable and can start a listening Flask server. That contradiction makes accidental misuse more likely, especially because the example contains real exploitable behaviors and can be executed directly.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The module explicitly states that code snippets and scan results may be sent to an external API for analysis. In a security-checking tool, transmitting source code, findings, or privacy-related scan data to a third party creates a real confidentiality and compliance risk, especially if users assume analysis is local-first and do not realize sensitive material leaves the environment.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The tool description says LLM functionality is disabled by default and local execution is prioritized, but the default run path enables privacy and data-security analyzers imported from `scripts.llm_analyzer`. If those analyzers use networked LLM backends or process sensitive source content externally, users may unknowingly send code or secrets to a third party, violating least surprise and privacy expectations.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The CLI advertises `--llm` as the switch that enables LLM analysis, but the flag is not actually used to control the privacy/data-security checks. This mismatch can mislead users into believing LLM functionality is off when it may still run, which is a security-relevant consent and data-handling flaw for a source-code scanning tool.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The document explicitly recommends changing the review status to “✅ Benign,” which is a security-backdoor pattern in documentation because it attempts to influence or override independent trust decisions. While it does not execute code or directly compromise systems, this kind of self-attestation can mislead reviewers and reduce scrutiny of real risks such as optional code exfiltration via the LLM feature.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation explicitly shows passing an API key via the command line, which can expose secrets through shell history, process listings, CI logs, and audit tooling. Because this is a security tool's documentation, users may copy-paste these examples directly, increasing the chance of credential leakage.

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: The file allows installation of pytest from versions >=7.0.0, and the static analysis indicates at least one affected version range includes a known advisory (CVE-2025-71176) related to vulnerable tmpdir handling. Although pytest is a development dependency rather than production runtime code, vulnerable test tooling can still affect CI environments, local developer machines, or workflows that process untrusted test artifacts.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: examples/unsafe-example/app.py:36

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/python_sec_check.py:257

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: examples/unsafe-example/app.py:13