ipython-analyst

• Outcome: Review
• Latest audit: Aug 6, 2026 · 9:58 PM UTC
• Version: 7.0.0

Overview

This is a transparent interactive Python analysis skill with powerful but purpose-aligned code execution and file handling, so users should treat uploaded code and debugging data carefully.

Install this only if you want the agent to run Python code, inspect uploaded files, analyze local scripts, and write generated files to the download area. Review untrusted code or expressions before execution, avoid printing tracebacks that may contain secrets, and clean up saved repro inputs or baselines that contain sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

eval() call detected

High

• Category: Dangerous Code Execution

Content

if allowed_names:
        allowed.update(allowed_names)
    try:
        return eval(expression, allowed, {})  # noqa: S307 — sandboxed namespace
    except NameError as e:
        raise ValueError(f"Unsafe or undefined name: {e}") from e

• Confidence: 92% confidence
• Finding: return eval(expression, allowed, {}) # noqa: S307 — sandboxed namespace

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill directs the agent to execute arbitrary Python and load local helper scripts via exec/open, while also reading from upload paths and writing downloadable outputs. Even though the file does not explicitly declare permissions, the documented behavior clearly enables code execution, filesystem access, environment inspection, and potentially shell/network access through Python libraries, creating a capability/permission mismatch that can bypass expected platform controls and increase the blast radius of prompt-injection or unsafe-user-input scenarios.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The `stress_test` logic contradicts its own contract: it treats parser exceptions as passes, also increments `passed` when the parser accepts input, and never increments `failed`. This can silently produce misleading test results, causing insecure or fragile parsers to appear robust and potentially be deployed without detecting acceptance of adversarial inputs.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The reference explicitly instructs the agent to load this skill for a very broad set of common programming requests, including generic phrases like 'debug this script' and 'parse this log.' In an agent-routing context, overly broad activation criteria can cause the Python-execution skill to be selected for requests that only need explanation or lightweight analysis, unnecessarily increasing exposure to code execution, file access, and other higher-risk capabilities.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The guidance explicitly tells the agent to save failing input to disk for replay without any warning or guardrails about sensitive data handling. In a debugging skill, failing inputs often contain production payloads, logs, credentials, tokens, PII, or proprietary code, so persisting them can create unintended data retention and secondary exposure risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The reference explicitly instructs users to execute a local Python script via exec(open(...).read()), which normalizes arbitrary code execution from the filesystem and omits any warning about code-execution or file-access side effects. In an interactive Python execution skill, this is more dangerous because users may copy these snippets directly, causing unintended execution of modified local files or scripts in a privileged workspace.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: `extract_traceback()` captures and returns frame locals by default, which can expose secrets, tokens, personal data, file contents, or other sensitive runtime state present during an exception. In this skill context, the function is explicitly intended for interactive debugging and exception review, which makes accidental disclosure more likely because the output may be surfaced to users or logged without redaction.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: `format_exception()` includes local variables in formatted exception output by default, which can leak sensitive in-memory data into user-visible responses, logs, transcripts, or debugging artifacts. Because this skill is designed to analyze crashes interactively, default exposure of locals is more dangerous than in a purely local developer-only tool: the data may be shared across trust boundaries during analysis.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/safe_execution.py:104