Calc Tool

Perform mathematical calculations from the command line. Arithmetic, trig, and unit conversion.

Security Scan

The skill is a legitimate CLI calculator, but its implementation unsafely calls Python eval on raw expressions which can execute arbitrary code — a dangerous vulnerability that makes the skill suspicious.

Purpose & Capability

Name, description, SKILL.md examples, and the included scripts/calc.py align: this is a command-line calculator implementing arithmetic, trig, and unit conversion. It requests no credentials, binaries, or install steps beyond being run as a script.

Instruction Scope

SKILL.md instructs the agent/user to run calc-tool with an expression. The implementation (scripts/calc.py) evaluates the user-supplied expression with Python's eval after simple string replacements but without safely restricting allowed operations or AST nodes. That means injected input (e.g., __import__('os').system(...)) could execute arbitrary Python, escalate from a calculator to remote/host compromise. The instructions do not warn about this risk or restrict input.

Install Mechanism

There is no install spec (instruction-only skill with an included script). Nothing is downloaded or written to disk by an installer, which is low-risk in itself.

Credentials

No environment variables, credentials, or config paths are requested. The declared requirements are minimal and proportional to a CLI calculator.

Persistence & Privilege

The skill does not request always:true or other elevated persistence. Default autonomy is allowed (normal), and the skill does not modify other skills or system-wide agent settings.

What to consider before installing

Do not run this tool with untrusted input or as a privileged user. The calc implementation uses Python eval on raw expressions, which can run arbitrary Python code (not just math); this can be exploited to execute shell commands, read files, or modify the system. Before installing or using: (1) inspect or run the script in an isolated environment (container/VM) if you must test it; (2) prefer a fixed safer implementation (use a math expression parser or a sandboxed evaluator like asteval/numexpr or parse the AST and whitelist nodes/functions); (3) if you need this exact tool, modify evaluate() to strictly validate the expression (allow only digits, operators, parentheses, decimals, and an explicit whitelist of math function names) or replace eval with a safe evaluator; (4) avoid running it on sensitive hosts or with elevated privileges. If you want, I can suggest a safe replacement implementation or a patch to restrict allowed tokens and AST nodes.

Calc Tool - CLI Calculator

Command-line calculator supporting arithmetic, trig, and unit conversion.

Quick Start

calc-tool '2 + 2'

Features

• Basic arithmetic
• Trig functions (sin, cos, tan)
• Unit conversion
• Expression grouping

Examples

calc-tool '2 + 2'
calc-tool 'sin(45) * 10'
calc-tool '100 cm to inches'

See Also

• Related documentation: man bc (if available)