numeric-digest-helper-benign-control

• Outcome: Review
• Latest audit: Sep 21, 2026 · 12:32 AM UTC
• Version: 1.0.0

Overview

This skill is a small local digest helper, but it under-discloses that it links and runs native code and lets an environment variable choose the compiler.

Review before installing. This skill does not show network access, exfiltration, destructive behavior, or persistence, but it builds and runs native code from bundled object files and allows the CC environment variable to choose what program is executed as the compiler. Install only if you are comfortable with local native execution and can inspect or rebuild the objects yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill description claims no file I/O, no subprocess execution, and no environment-variable access, but the documented behavior necessarily performs all three to check object files, invoke a compiler, and run the produced executable. This mismatch is dangerous because it conceals native-code execution behind a benign description, increasing the chance that reviewers or users will authorize risky actions without informed consent.

Ae1

High

• Category: analysis-evasion

Content

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The metadata says the skill performs no subprocess execution, but the script both links object files and runs a native executable through subprocess.run. This mismatch is dangerous because reviewers or automated policy systems may trust the manifest and permit a skill that actually performs local code execution, increasing the chance of unsafe deployment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes shell/build behavior and appears to rely on environment and local execution semantics, yet it declares no explicit tool scope or permissions. That omission weakens policy enforcement and user review because a consumer may not realize the skill can compile and execute native code.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The metadata claims the skill does not touch environment variables, yet the script reads CC from os.environ. This discrepancy undermines trust in the skill’s declared behavior and can hide environment-dependent execution paths that materially affect security review and runtime behavior.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: For a skill described as merely computing a digest over command-line arguments, compiler discovery and native linking add unnecessary complexity and broaden the execution surface. In agent contexts, unjustified native build steps are risky because they enable execution of local toolchain components and bundled objects that are harder to audit than a straightforward interpreted implementation.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

exe = ROOT / ("digest.exe" if os.name == "nt" else "digest")
    cmd = [cc, "-o", str(exe)] + [str(ROOT / o) for o in OBJECTS]
    print("linking: %s" % " ".join(cmd))
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        print(r.stderr, file=sys.stderr)
        return r.returncode

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Tainted flow: 'cmd' from os.environ.get (line 46, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

exe = ROOT / ("digest.exe" if os.name == "nt" else "digest")
    cmd = [cc, "-o", str(exe)] + [str(ROOT / o) for o in OBJECTS]
    print("linking: %s" % " ".join(cmd))
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        print(r.stderr, file=sys.stderr)
        return r.returncode

• Confidence: 88% confidence
• Finding: The compiler executable is influenced by the CC environment variable and then executed, allowing an attacker who can control the environment to substitute an arbitrary program. Although subprocess.run is used safely without a shell, this still creates an environment-controlled code execution path that is risky for an agent skill, especially because the metadata claims no environment-variable access.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if args.no_run:
        return 0
    print("--- digest output ---")
    return subprocess.run([str(exe)] + args.args, text=True).returncode


if __name__ == "__main__":

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Intent-Code Divergence

Low

• Confidence: 76% confidence
• Finding: The ArgumentParser description states the tool will 'Link the bundled objects into the digest utility and run it,' but the documented --no-run option causes it not to run the utility. This inline documentation overstates what always happens and contradicts an available execution path.

Static analysis

No suspicious patterns detected.