delete-when-unzip

• Outcome: Review
• Latest audit: Sep 2, 2026 · 2:19 AM UTC
• Version: 0.1.1

Overview

The skill does what it says, but it handles local archives destructively and has unsafe code paths that could run code or write files outside the intended output folder.

Install only if you fully understand that this tool is designed to destroy the original archive during extraction. Do not run it on your only copy, do not pass untrusted chunk-size values, and avoid using it on untrusted archives until eval() is removed, output paths are contained, and destructive deletion requires an explicit runtime confirmation or dry run.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

eval() call detected

High

• Category: Dangerous Code Execution

Content

file_path = file_entry.get()
    number = number_entry.get()
    number = eval(number)*1024*1024
    # number = str(number)
    mode = var_mode.get()

• Confidence: 99% confidence
• Finding: The GUI reads a user-controllable string from the chunk-size input and passes it directly to eval(). That enables arbitrary Python code execution in the context of the application, not just numeric parsing, so a crafted value could run commands, read files, or alter program behavior. In this skill context, the app is explicitly intended to be run locally on user files, which makes code execution especially dangerous because it executes with the user's filesystem access.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = 1024*1024*512.0  # 512MB per chunk
    if len(sys.argv) > 2:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])

• Confidence: 99% confidence
• Finding: The script evaluates attacker-controlled command-line input with eval(), which enables arbitrary Python code execution when a user supplies the chunk size argument. In this skill’s context, users are explicitly instructed to run the script locally, so exploitation directly becomes local code execution under the user's privileges.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
        password = sys.argv[3]
    main_unzip(FILE_PATH,CHUNK_SIZE,password)

• Confidence: 99% confidence
• Finding: This is a second reachable eval() on the same untrusted CLI parameter path, again allowing arbitrary Python execution instead of simple chunk-size parsing. Because the skill is meant to be copied and executed by end users on their own systems, this bug is especially dangerous and not merely a correctness issue.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = 1024*1024*512.0  # 512MB per chunk
    if len(sys.argv) > 2:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])

• Confidence: 99% confidence
• Finding: The script evaluates sys.argv[2] with eval(), allowing arbitrary Python expression execution if an attacker can influence the chunk-size argument. In a utility that is only supposed to parse a numeric chunk size, this creates direct code-execution risk unrelated to the stated archive-extraction purpose.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
        password = sys.argv[3]
    main_unzip(FILE_PATH,CHUNK_SIZE,password)

• Confidence: 99% confidence
• Finding: This is a second reachable eval() on the same untrusted command-line parameter path, again enabling arbitrary Python code execution. Repeating the pattern in multiple branches increases the chance the unsafe behavior remains exploitable in normal use.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = 1024*1024*512.0  # 512MB per chunk
    if len(sys.argv) > 2:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])

• Confidence: 99% confidence
• Finding: The script evaluates user-controlled CLI input with eval(sys.argv[2]), which enables arbitrary Python code execution if an attacker can influence the chunk-size argument. In a file-handling utility that users may run locally on valuable data, this becomes especially dangerous because exploitation yields code execution with the user's privileges in addition to the script's destructive archive-deletion behavior.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
        password = sys.argv[3]
    CHUNK_SIZE = 10_240_000
    main_unzip(FILE_PATH,CHUNK_SIZE,password)

• Confidence: 99% confidence
• Finding: This is a second reachable eval() on the same user-controlled argument path, again allowing arbitrary code execution through the command line. Even though the value is later overwritten by a fixed CHUNK_SIZE, the eval still executes first, so malicious expressions can run for side effects before normal extraction proceeds.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = 1024*1024*512.0  # 512MB per chunk
    if len(sys.argv) > 2:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])

• Confidence: 99% confidence
• Finding: The script evaluates user-controlled command-line input with eval(sys.argv[2]), which allows arbitrary Python code execution. Anyone who can influence the argument can run commands with the privileges of the user executing the script, making this a direct code execution vulnerability.

eval() call detected

High

• Category: Dangerous Code Execution

Content

CHUNK_SIZE = eval(sys.argv[2])
    if len(sys.argv) > 3:
        FILE_PATH = sys.argv[1]
        CHUNK_SIZE = eval(sys.argv[2])
        password = sys.argv[3]
    CHUNK_SIZE = 10_240_000
    main_unzip(FILE_PATH,CHUNK_SIZE,password)

• Confidence: 99% confidence
• Finding: This is the same unsafe pattern repeated in the branch handling three arguments: eval(sys.argv[2]) executes attacker-supplied Python code. Although CHUNK_SIZE is later overwritten, the eval still runs first, so arbitrary code execution still occurs.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill explicitly instructs the agent to read local archive files and run shell commands, yet no permissions are declared. That mismatch is dangerous because it can lead to execution of file and process operations without transparent user/admin review, especially in a skill that deletes source archives during operation.

Context-Inappropriate Capability

Medium

• Confidence: 78% confidence
• Finding: The documentation tells users to obtain and run an external unrar binary from the internet when the bundled path does not work. Inviting ad hoc binary download and execution expands the trust boundary far beyond simple archive extraction and creates supply-chain and remote-code-execution risk if the binary is tampered with or the source is spoofed.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill admits that chunk_size is parsed with eval(), meaning a user-supplied CLI argument can execute arbitrary Python code. In the context of a shell-capable skill handling local files, this turns a simple archive option into a direct code-execution primitive and is unrelated to the legitimate functionality of choosing a numeric chunk size.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: This file implements a ZIP-style weak decryption routine (`weak_decrypt`) that is unrelated to the declared skill purpose of low-space archive extraction with deletion. Even if the algorithm is only for legacy ZIP handling, embedding decryption capability in a skill whose stated function is file extraction/destructive cleanup expands the skill's power into credentialed or protected-content processing without clear justification, which is a risky hidden capability.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The module provides general weak decryption logic and key-update primitives that go beyond what is necessary for a narrowly scoped unzip-and-delete workflow. In this context, undeclared decryption functionality is suspicious because it can enable processing of protected archives while the skill also deletes source material, reducing user visibility and recovery options if misused.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: This file implements ZIPCrypto password-based decryption logic, which is outside the stated purpose of a skill meant for space-efficient archive extraction and deletion. Scope-expanding crypto/decryption code increases risk because it may enable handling protected archives in ways users did not expect, and it introduces security-sensitive functionality without clear authorization, validation, or documentation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The skill metadata promises ZIP and segmented ZIP support, but the implementation only runs unrar and only appends RAR-style parts to the deletion queue. In a destructive workflow whose core behavior is deleting source parts during extraction, this mismatch is dangerous because users may trust the tool to safely process ZIP volumes when it does not, leading to failed recovery, partial extraction, or unintended data loss.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The code defines ZIP-related regexes but comments out their use, while the docstring still states the tool performs streaming extraction and deletion of processed segmented archives. That discrepancy makes the deletion semantics unpredictable for users and is especially risky here because the skill is explicitly marketed for low-disk-space, destructive extraction scenarios where users may have no backup after trusting the advertised behavior.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The command-line interface executes arbitrary Python expressions from user input even though the tool's purpose is only archive extraction and deletion. That mismatch makes the behavior especially dangerous because users would not expect a size parameter to become a code-execution primitive.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: Archive entry names are joined directly to the extraction root without normalization or containment checks. A malicious archive can use ../ sequences or absolute paths to overwrite files outside the intended directory, enabling arbitrary file write and possible code or configuration tampering.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The script scans the entire sibling directory for files matching broad multipart-archive name patterns, then adds them to a global deletion list. In this skill's context, automatic deletion is the core feature, so overly broad matching increases the chance of deleting unrelated files that merely resemble archive segments.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The bundled executable is not narrowly scoped to the skill's stated purpose of extraction with deletion of processed parts. Embedded command/help strings show broad archive-management functions such as adding, deleting, repairing, locking, converting SFX, and recovery operations, which materially expand the attack surface and create opportunities for destructive or unintended behavior if the binary is invoked with attacker-influenced arguments.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The binary contains support for privileged filesystem and security operations such as ownership/ACL handling, symbolic link creation, and Windows privilege-related functionality that is unrelated to a simple low-space extraction helper. In the context of unpacking untrusted archives, these capabilities increase the risk of writing unsafe links, altering protected filesystem metadata, or enabling filesystem abuse beyond ordinary extraction.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The executable exposes power-control behavior such as shutdown/suspend-related functionality, which is unjustified for a skill whose purpose is archive extraction under low disk space. Even if not triggered in normal use, bundling such functionality means misuse of flags or attacker-controlled invocation could disrupt availability or user workflows.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The script unconditionally deletes the source archive after processing without an in-script prompt, dry-run mode, or confirmation gate. In this skill’s context, the whole workflow is intentionally destructive and aimed at low-disk-space situations, which increases the likelihood of accidental irreversible data loss if extraction is incomplete, paths are wrong, or the archive was the only copy.

Natural-Language Policy Violations

Medium

• Confidence: 77% confidence
• Finding: Forcibly decoding archive entry names as GBK can corrupt filenames, mis-handle archives created with other encodings, and undermine path validation assumptions. In archive extraction code, incorrect filename decoding can contribute to writing files to unintended locations or overwriting unexpected paths if name normalization behaves differently than intended.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: app.py:193

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: delete_when_unzip_multi.py:84

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: delete_when_unzip_rar_multi.py:167

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: delete_when_unzip_rar.py:161

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: delete_when_unzip.py:74