Bc Calc

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:26 AM UTC
• Version: 1.0.0

Overview

This calculator skill is coherent, but it runs unrestricted bc programs from user input without resource limits, which could hang or exhaust a worker.

Install only if you trust the environment to run calculator inputs and can tolerate availability risk. Prefer adding strict expression validation, input/output caps, and a subprocess timeout before using this with untrusted or automated inputs.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:5

Finding

Unbounded bc Execution Permits Denial of Service

Content

View full analysis

Vulnerability Details

File Location: index.js, lines 5–17
Vulnerability Type: Unrestricted execution of resource-intensive calculator programs
Risk Level: Medium

Vulnerable Code

js

function runBc(expr) {
  return new Promise((resolve, reject) => {
    const bc = spawn('bc', ['-l', '-q']);
    let out = '';
    let err = '';
    bc.stdout.on('data', chunk => (out += chunk));
    bc.stderr.on('data', chunk => (err += chunk));
    bc.on('error', reject);
    bc.on('close', code => {
      if (code !== 0) reject(new Error(err.trim() || `bc exited with code ${code}`));
      else resolve(out.trim());
    });
    bc.stdin.write(expr + '\n');
    bc.stdin.end();
  });
}

Technical Analysis

User-controlled input is submitted to the full bc language without restrictions. Although spawn() uses a fixed executable and argument array and therefore does not directly invoke a command shell, bc itself supports control flow and computationally expensive programs.

The wrapper enforces no input-length, execution-time, CPU, memory, or output-size limit. It also accumulates all standard output and standard error in memory. Consequently, a non-terminating program, an expensive arbitrary-precision computation, or a loop that continuously generates output can keep the child process active indefinitely or exhaust host resources.

Attack Path

1. An attacker supplies a malicious calculator program through command-line arguments or standard input.
2. main() accepts the unrestricted input and passes it to runBc().
3. runBc() starts bc and writes the attacker-controlled program to its standard input.
4. A payload such as while(1) {} runs indefinitely because no timeout exists.
5. Alternatively, a computation or output loop consumes excessive CPU or causes the Node.js process to retain unbounded output in memory.
6. The affected worker remains occupied or terminates because ...[truncated 427 chars]

Remediation

View remediation

Remediation Suggestions

• Enforce a strict maximum input length before starting bc.
• Apply an execution deadline and terminate overdue child processes, escalating to SIGKILL if graceful termination fails.
• Cap captured standard output and standard error; terminate the child when either limit is exceeded.
• If the intended feature only requires arithmetic expressions, parse or allowlist supported expression syntax and reject loops, function definitions, and other programmable constructs.
• Run the calculator under operating-system CPU, memory, process, and file-descriptor limits where available.
• Return a controlled error when any input, runtime, or output limit is reached.
• Add tests covering infinite loops, very large computations, oversized inputs, and unbounded-output programs.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is broad enough to match very common requests such as 'calculate' or even simple questions like 'what is 1+1', which increases the chance this skill is invoked in situations where a more constrained or context-aware handler should be used. While the skill itself is a calculator, overbroad triggering can cause inappropriate tool selection and unnecessary execution of a command-processing skill on untrusted user input.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger definition says the skill activates for 'Any math expression evaluation request' without boundaries, which is underspecified and likely to overlap with many ordinary conversations, educational prompts, or mixed-content requests. In a system that auto-selects skills, this can lead to over-invocation on attacker-supplied input and expand the attack surface of a shell-backed tool unnecessarily.

Content

No source excerpt is available for this finding.