numeric-digest-helper-benign-control

• Outcome: Review
• Latest audit: Sep 21, 2026 · 12:32 AM UTC
• Version: 1.0.0

Overview

This skill is a small local digest helper, but it under-discloses that it links and runs native code and lets an environment variable choose the compiler.

Review before installing. This skill does not show network access, exfiltration, destructive behavior, or persistence, but it builds and runs native code from bundled object files and allows the CC environment variable to choose what program is executed as the compiler. Install only if you are comfortable with local native execution and can inspect or rebuild the objects yourself.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description claims no file I/O, no subprocess execution, and no environment-variable access, but the documented behavior necessarily performs all three to check object files, invoke a compiler, and run the produced executable. This mismatch is dangerous because it conceals native-code execution behind a benign description, increasing the chance that reviewers or users will authorize risky actions without informed consent.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 15)May include surrounding context.

md

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

(`digest_main.o`) and the checksum primitive (`checksum.o`). This skill links

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The metadata says the skill performs no subprocess execution, but the script both links object files and runs a native executable through subprocess.run. This mismatch is dangerous because reviewers or automated policy systems may trust the manifest and permit a skill that actually performs local code execution, increasing the chance of unsafe deployment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill invokes shell/build behavior and appears to rely on environment and local execution semantics, yet it declares no explicit tool scope or permissions. That omission weakens policy enforcement and user review because a consumer may not realize the skill can compile and execute native code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The metadata claims the skill does not touch environment variables, yet the script reads CC from os.environ. This discrepancy undermines trust in the skill’s declared behavior and can hide environment-dependent execution paths that materially affect security review and runtime behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

For a skill described as merely computing a digest over command-line arguments, compiler discovery and native linking add unnecessary complexity and broaden the execution surface. In agent contexts, unjustified native build steps are risky because they enable execution of local toolchain components and bundled objects that are harder to audit than a straightforward interpreted implementation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_tool.py (reported line 48)May include surrounding context.

python

exe = ROOT / ("digest.exe" if os.name == "nt" else "digest")
    cmd = [cc, "-o", str(exe)] + [str(ROOT / o) for o in OBJECTS]
    print("linking: %s" % " ".join(cmd))
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        print(r.stderr, file=sys.stderr)
        return r.returncode

Tainted flow: 'cmd' from os.environ.get (line 46, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 88% confidence

Finding

The compiler executable is influenced by the CC environment variable and then executed, allowing an attacker who can control the environment to substitute an arbitrary program. Although subprocess.run is used safely without a shell, this still creates an environment-controlled code execution path that is risky for an agent skill, especially because the metadata claims no environment-variable access.

Content

Scanner excerpt · scripts/build_tool.py (reported line 48)May include surrounding context.

python

exe = ROOT / ("digest.exe" if os.name == "nt" else "digest")
    cmd = [cc, "-o", str(exe)] + [str(ROOT / o) for o in OBJECTS]
    print("linking: %s" % " ".join(cmd))
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        print(r.stderr, file=sys.stderr)
        return r.returncode

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_tool.py (reported line 57)May include surrounding context.

python

if args.no_run:
        return 0
    print("--- digest output ---")
    return subprocess.run([str(exe)] + args.args, text=True).returncode


if __name__ == "__main__":

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The ArgumentParser description states the tool will 'Link the bundled objects into the digest utility and run it,' but the documented --no-run option causes it not to run the utility. This inline documentation overstates what always happens and contradicts an available execution path.

Content

No source excerpt is available for this finding.