Python Auto Dev

• Outcome: Review
• Latest audit: May 29, 2026 · 9:25 PM UTC
• Version: 1.0.0

Overview

This is a coherent Python automation skill, but it needs Review because its test and optimization scripts can turn user-controlled paths into Windows shell commands.

Install only in a dedicated Windows conda environment and use it on trusted project files. Avoid unusual or untrusted path names until the scripts stop using cmd.exe with joined command strings, and inspect generated code before running tests or profiling.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

conda_activate_cmd = f'call {DEFAULT_CONDA_PATH} activate {DEFAULT_ENV}'
    full_cmd = f"{conda_activate_cmd} && {' '.join(command)}"

    proc = subprocess.run(
        ["cmd.exe", "/c", full_cmd],
        capture_output=True,
        text=True,

• Confidence: 95% confidence
• Finding: The script constructs a shell command string with `full_cmd = ... && {' '.join(command)}` and executes it via `cmd.exe /c`. Because `command` includes user-influenced values such as the target file path, shell metacharacters in paths or arguments can alter command flow and lead to command injection. In this skill context, the script is explicitly designed to run user-supplied code and tools, which makes shell-mediated execution materially more dangerous.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

full_cmd = f"{conda_activate_cmd} && {' '.join(command)}"

    # Run via cmd.exe
    proc = subprocess.run(
        ["cmd.exe", "/c", full_cmd],
        capture_output=True,
        text=True,

• Confidence: 95% confidence
• Finding: The script builds a single shell command string and executes it via `cmd.exe /c`, which causes user-influenced arguments such as `test_dir` and `junit_xml` to be interpreted by the Windows shell. Because `full_cmd` is assembled with `' '.join(command)` and no quoting or escaping, an attacker can inject shell metacharacters like `&`, `|`, or `>` through command-line inputs and achieve arbitrary command execution.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: This script intentionally executes the target Python file under `cProfile` and also runs external developer tools, which means analysis of an untrusted file results in code execution. That is dangerous because a user expecting static optimization help may instead run attacker-controlled Python with the analyst's privileges and environment. The skill context increases risk because 'optimization' sounds like analysis, but `--run-profile` causes real execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill describes automatic code generation and storage under a fixed local path but does not clearly warn that it will write files to a hard-coded directory on the host. This can surprise users, overwrite existing content, leak sensitive generated artifacts into an unintended location, or create persistence on the local machine without explicit informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that scripts are called directly and handle conda activation internally, but it does not prominently warn that it will execute tests and auxiliary scripts automatically in the local conda environment. Running generated or modified code and test suites on the host can trigger arbitrary code execution, dependency abuse, filesystem changes, or network activity, especially because the workflow includes debugging and patching steps.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: Profiling the target file with `python -m cProfile ... <file>` executes the file, but the script provides only a mild 'may take time' hint rather than a clear warning that arbitrary code will run. If a user profiles an untrusted Python file, that file can perform any actions available to the current user account. In a code-assistance skill, this hidden execution behavior is especially risky.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This is the core command-injection issue: user-controlled values flow into `command`, then into `full_cmd`, then into `cmd.exe /c` without escaping. In this testing utility, the inputs are expected to be paths, but the shell will treat crafted path strings as control syntax, making the context more dangerous because the tool is likely run in a developer environment with broad filesystem and credential access.

Unvalidated Output Injection

High

• Category: Output Handling

Content

full_cmd = f"{conda_activate_cmd} && {' '.join(command)}"

    # Run via cmd.exe
    proc = subprocess.run(
        ["cmd.exe", "/c", full_cmd],
        capture_output=True,
        text=True,

• Confidence: 93% confidence
• Finding: The subprocess execution point becomes an output/command injection sink because untrusted input is incorporated into a shell command string before execution. In a local developer tooling context, successful exploitation can run arbitrary OS commands with the user's privileges, potentially exposing source code, tokens, SSH keys, or CI credentials present on the machine.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.