Agent Cost Tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 2.0.1

Overview

The packaged cost tracker is a simple local estimator, but its docs tell users to download and run unpinned remote Python code and include under-disclosed CI scripts that can execute local Python files.

Review carefully before installing. Prefer using the packaged agent_cost_tracker.py directly instead of the curl command, or require a pinned commit and checksum. Avoid running ci/verify_product.py on untrusted folders unless it is sandboxed with no secrets or network access. Expect only basic local cost estimation/tallying, not full budget alerts or CSV export as advertised.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:34

Finding

Mutable Remote Python Payload Downloaded and Subsequently Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:34
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

bash

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/agent-cost-tracker/main/agent_cost_tracker.py
# Or copy the file anywhere — it's self-contained.

The downloaded filename is subsequently used by the documented quick-start commands:

bash

python agent_cost_tracker.py self-test     # prove it works end-to-end
python agent_cost_tracker.py tally --help   # tally subcommand
python agent_cost_tracker.py estimate --help   # estimate subcommand

Technical Analysis

The installation instructions retrieve executable Python code from the mutable main branch of a repository controlled through a personal GitHub account. The command does not pin an immutable commit, validate a cryptographic checksum, or verify a signature.

Consequently, the code users execute can differ from the version included in and reviewed as part of this skill package. This behavior is unnecessary for the declared local cost-estimation functionality because agent_cost_tracker.py is already shipped in the package and has no runtime dependency requiring a network download.

HTTPS protects the transfer in transit but does not protect against repository compromise, maintainer-account compromise, or a malicious future modification to the referenced branch.

Attack Path

1. An attacker compromises the repository, its maintainer account, or another mechanism authorized to update the main branch.
2. The attacker replaces agent_cost_tracker.py on that branch with a malicious Python payload.
3. A user follows the installation command in SKILL.md.
4. curl saves the attacker-controlled response as agent_cost_tracker.py, potentially overwriting a local file of the same name.
5. The user follows the quick-start instructions and invoke ...[truncated 543 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the remote-download instruction and direct users to execute the reviewed agent_cost_tracker.py already included in the skill package.
• If remote installation must remain supported, use an immutable URL pinned to a specific commit rather than the mutable main branch.
• Publish a trusted SHA-256 digest and require verification before execution, for example with sha256sum --check.
• Prefer signed release artifacts and document signature verification.
• Download to a newly created temporary file, verify it, and only then move it into place to avoid silently overwriting an existing script.
• Ensure CI verifies that the pinned artifact is byte-for-byte identical to the packaged and audited implementation.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: README.md:36

Finding

README Installs Executable Code from a Mutable Remote Branch

Content

View full analysis

Vulnerability Details

File Location: README.md:36
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Medium

bash

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/agent-cost-tracker/main/agent_cost_tracker.py
# Or copy the file anywhere — it's self-contained.

The README then instructs users to execute the downloaded filename:

bash

python agent_cost_tracker.py self-test     # prove it works end-to-end
python agent_cost_tracker.py tally --help   # tally subcommand
python agent_cost_tracker.py estimate --help   # estimate subcommand

Technical Analysis

The README directs users to retrieve Python code from the mutable main branch without a pinned revision, checksum, or signature. This creates a time-of-review versus time-of-use gap: future users may execute remote content that was not present during this audit.

The remote fetch exceeds the minimum access necessary for the skill. The audited package already contains a self-contained Python script, and its implemented cost-estimation and log-tallying operations require no network access.

Attack Path

1. The upstream repository or maintainer account is compromised, or the mutable branch is otherwise modified maliciously.
2. A malicious version of agent_cost_tracker.py is placed at the documented URL.
3. A user copies the README installation command.
4. The remote payload is written into the user's current directory as agent_cost_tracker.py.
5. The user invokes one of the documented Python commands.
6. The malicious code runs under the user's or automation runner's security context.

Impact Assessment

Successful exploitation provides code execution with the privileges of the user or CI process following the README. Accessible files, environment variables, credentials, user-owned configuration, and network connectivity could be exposed or modif ...[truncated 117 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the download command with instructions that use the script distributed inside the reviewed package.
• If a standalone download is necessary, reference a specific immutable commit or versioned signed release.
• Supply and verify a cryptographic checksum before any Python invocation.
• Clearly separate download, verification, and execution steps so users do not execute unverified content.
• Keep installation instructions synchronized between README.md and SKILL.md to prevent the unsafe command from being reintroduced from one copy.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The strongest mismatch finding reports filesystem inspection, subprocess execution, compilation checks, and secret-pattern scanning, all of which are materially more sensitive than passive spend estimation. In the context of an agent skill, hidden execution and scanning capabilities can expose source code, trigger unintended commands, or access secrets from local repositories.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding reports filesystem inspection, subprocess execution, compilation checks, and secret-pattern scanning, all of which are materially more sensitive than passive spend estimation. In the context of an agent skill, hidden execution and scanning capabilities can expose source code, trigger unintended commands, or access secrets from local repositories.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The strongest mismatch finding reports filesystem inspection, subprocess execution, compilation checks, and secret-pattern scanning, all of which are materially more sensitive than passive spend estimation. In the context of an agent skill, hidden execution and scanning capabilities can expose source code, trigger unintended commands, or access secrets from local repositories.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises executable usage and CI integration but does not declare any explicit tool scope such as allowed shell or file access. In an agent environment, missing permission boundaries can cause the platform or operator to grant broader capabilities than intended, increasing the chance of unsafe file inspection or command execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a richer tracking tool that should maintain spending by agent/session, issue budget alerts, and support CSV export. The implemented script is a simple CLI estimator that reads a logfile, totals token counts, and prints JSON or plain text output; there is no agent/session accounting, alerting, or CSV generation anywhere in the file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

This helper executes arbitrary Python files from the target product directory as part of verification. In a CI or local review context, a malicious skill author can place harmful code in a .py file that returns PASS for a self-test while also exfiltrating secrets or modifying the environment, causing code execution during analysis.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python

def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python

all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This executes any test_*.py or *_test.py file found in the product folder, which gives an untrusted skill author arbitrary code execution during verification. In CI, that can expose repository secrets, tokens, network credentials, or allow tampering with build outputs while still making the tests pass.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python

tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python

# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

Static analysis

No suspicious patterns detected.