ClawHub
Back to skill

Security audit

Cn Math Expression

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a math evaluator, but its implementation uses Python eval on supplied expressions, which gives it broader execution behavior than a simple calculator should have.

Review this skill before installing. It does not show evidence of malware or persistence, but a math tool that uses Python eval should only be used with trusted expressions or after replacing the evaluator with a restricted parser.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

eval() call detected

High
Category
Dangerous Code Execution
Content
}

def safe_eval(expr):
    return eval(expr, {"__builtins__": {}}, SAFE_NAMES)

def main():
    parser = argparse.ArgumentParser(description="Math Expression Evaluator")
Confidence
93% confidence
Finding
return eval(expr, {"__builtins__": {}}, SAFE_NAMES)

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/math_eval.py:12