Ops Helper Builder (Control)

• Outcome: Review
• Latest audit: Sep 17, 2026 · 8:08 AM UTC
• Version: 1.0.0

Overview

This skill openly builds and runs a bundled helper, but it does so from opaque native object files with automatic execution and under-described telemetry behavior.

Review this before installing. It will build and run native code from bundled object files in your local user context, and the telemetry component is not clearly documented. Install only if you trust the publisher and are comfortable with a native helper running without source-level review, integrity verification, or a clear opt-out from execution.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

1. Ensure the object files are present at `helper_main.o` and `telemetry.o`.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

1. Ensure the object files are present at `helper_main.o` and `telemetry.o`.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill explicitly builds and executes a binary from bundled precompiled object files, which gives it shell/code-execution capability, yet it declares no tool scope or permission boundaries. Because the executable is assembled from opaque compiled objects rather than reviewable source, users and agents cannot meaningfully inspect what will run, increasing the risk of arbitrary code execution or hidden post-build behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill states that a telemetry object is linked into the helper but does not clearly warn the user that running the helper may activate telemetry functionality. That omission undermines informed consent and can conceal data collection, network communication, or environment disclosure during routine execution, especially since the telemetry logic is compiled and not transparent.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/build_helper.py (reported line 47)May include surrounding context.

python

exe = ROOT / ("helper.exe" if os.name == "nt" else "helper")
    cmd = [cc, "-o", str(exe)] + [str(ROOT / o) for o in OBJECTS]
    print("linking: %s" % " ".join(cmd))
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        print(r.stderr, file=sys.stderr)
        return r.returncode

Tainted flow: 'cmd' from os.environ.get (line 45, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow
• Confidence: 97% confidence

Finding

The compiler executable is taken from the CC environment variable and then executed without validation. In environments where an attacker can influence environment variables, this allows substitution of an arbitrary program in place of the compiler, resulting in immediate arbitrary command execution during the build step.

Content

Scanner excerpt · scripts/build_helper.py (reported line 47)May include surrounding context.

python

exe = ROOT / ("helper.exe" if os.name == "nt" else "helper")
    cmd = [cc, "-o", str(exe)] + [str(ROOT / o) for o in OBJECTS]
    print("linking: %s" % " ".join(cmd))
    r = subprocess.run(cmd, capture_output=True, text=True)
    if r.returncode != 0:
        print(r.stderr, file=sys.stderr)
        return r.returncode

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The script automatically executes the newly linked helper binary built from precompiled object files. Because object files are opaque machine code and are only checked for existence, running the produced executable can execute untrusted or trojanized native code from the repository or deployment package, leading to arbitrary code execution in the current user's context.

Content

Scanner excerpt · scripts/build_helper.py (reported line 55)May include surrounding context.

python

if args.run:
        print("--- helper output ---")
        return subprocess.run([str(exe)], text=True).returncode
    return 0

Static analysis

No suspicious patterns detected.