Security audit
Security checks for vulnerabilities and agentic risk
This Windows CAE automation skill does what it says, but it exposes broad local executable-launch and force-close behavior with weak safeguards.
Review this skill before installing. It should only be used in a trusted local CAE workstation workflow, with trusted config.json files and trusted executable paths. Avoid opening Abaqus .py or .jnl files unless you intend to execute them, and require user confirmation before force-closing applications or saving new executable paths.
skill_runner.py:38Caller-Controlled Configuration Enables Arbitrary Local Executable Launch and Process Termination
cae_launcher.py:347Opening Abaqus Python or Journal Files Executes Their Contents Without Explicit Confirmation
cae_launcher.py:329Bare Abaqus Command Resolution Allows Local Tool Spoofing
The skill explicitly controls local Windows applications, opens arbitrary files, and saves executable paths, which implies shell execution plus file read/write behavior, yet it declares no tool scope or permission boundaries. Without an explicit allowlist of tools and operations, an agent runtime may grant broader-than-necessary capabilities, increasing the chance of unauthorized process execution, unsafe file access, or misuse of user-supplied paths.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _tasklist_output() -> str:
try:
return subprocess.check_output(
["tasklist"],
text=True,
encoding="gbk",
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
errors="ignore"
).lower()
except Exception:
return subprocess.check_output(
["tasklist"],
text=True,
encoding="utf-8",
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
try:
if app == "abaqus":
p = subprocess.Popen(
command,
creationflags=subprocess.CREATE_NEW_CONSOLE
)
This call executes exe_path obtained from configuration or user-saved paths, so a user-controlled or tampered config can cause arbitrary local executables to be launched. In the context of an agent skill that accepts and persists executable paths, this becomes a straightforward arbitrary code execution primitive under the agent's privileges.
creationflags=subprocess.CREATE_NEW_CONSOLE
)
else:
p = subprocess.Popen(command, shell=False)
return ok(
message=f"{app} 已启动",
Although the Abaqus command is tokenized, it appends user-supplied file paths as command arguments to an external interpreter-style launcher (cmd /k abaqus ...). This can be dangerous because opening script-capable file types such as .py and .jnl may trigger execution of attacker-controlled content in the CAE application, turning file-open into code execution.
command = build_open_file_command(app, exe_path, file_path)
if app == "abaqus":
p = subprocess.Popen(
command,
creationflags=subprocess.CREATE_NEW_CONSOLE
)
This call runs a configured executable path and passes a user-provided file path to it. In this skill, both the executable path and the opened document can be attacker-influenced, so the function can be abused to execute an arbitrary program or to feed a malicious project/script file into a trusted CAE application that may process active content.
creationflags=subprocess.CREATE_NEW_CONSOLE
)
else:
p = subprocess.Popen(command, shell=False)
return ok(
message=f"已使用 {app} 打开文件",
The skill can force-kill configured application processes, including with /F, without any built-in confirmation, save prompt handling, or user-facing warning. In a CAE workflow this can cause loss of unsaved engineering work and can be abused by a caller to disrupt local applications, making the automation context more dangerous than a normal helper utility.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd.append("/F")
try:
result = subprocess.run(
cmd,
capture_output=True,
text=True,
The close_app branch passes force=args.get("force", True), which defaults to forceful application termination. This is a potentially destructive action that may cause unsaved work to be lost, but the file provides no confirmation prompt, warning message, or explanatory comment/docstring disclosing that behavior.
User-facing status and error messages throughout the file are written exclusively in Chinese, such as configuration, launch, and failure messages. This imposes a language choice without any visible opt-in or fallback, which is a natural-language locale policy concern under the stated rules.
The unknown-skill error message uses the Chinese text '未知 skill' directly, which forces a specific language in user-facing output. There is no indication that the skill is region-specific or that users can opt into this locale.
No suspicious patterns detected.