T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:32- Finding
Unpinned Remote Python Payload Download and Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Logger
Security checks for vulnerabilities and agentic risk
Overview
The log analyzer itself is local and purpose-aligned, but its documentation tells users to download executable Python from an unpinned GitHub branch and it ships an auxiliary verifier that can execute files from target folders.
Install only from the reviewed package copy or a pinned, verified release. Avoid the documented raw-GitHub main-branch curl command unless you independently trust the current upstream file. Do not run ci/verify_product.py on third-party or untrusted folders outside a disposable sandbox with no secrets or network access.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
ci/verify_product.py:34- Finding
Verification Harness Executes Untrusted Product Files Without Isolation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The verifier silently executes discovered Python files for
self-testwithout warning the user. In a workflow meant to evaluate third-party or untrusted products, this lack of disclosure increases the chance that analysts or CI systems will unknowingly execute hostile code.- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 97% confidence
- Finding
This function executes an arbitrary Python file from the target product directory as part of verification. In this repository context, the verifier is explicitly intended to inspect untrusted skills, so running their code during analysis can trigger arbitrary code execution on the CI runner or analyst workstation.
- Content
python def has_self_test(fp): r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30) return r.returncode == 0 and "PASS" in r.stdout
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python all_ok &= axis(False, "frontmatter (no SKILL.md)") all_ok &= axis(False, "docs (no SKILL.md)") # 3 compiles comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp], capture_output=True).returncode == 0 for fp in files) all_ok &= axis(comp_ok, "compiles (py_compile all .py)") # 4 self-test (any of 3 valid forms)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Test files are executed automatically with no explicit user-facing notice that verification will run untrusted code. This is dangerous because users may assume the tool is performing passive analysis when it is actually executing attacker-controlled scripts from the scanned product.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
This code executes discovered
test_*.pyfiles from the product directory as subprocesses. Because skills/products are potentially adversarial input, a malicious test file can run arbitrary commands, exfiltrate CI secrets, or alter the environment under the guise of verification.- Content
python tests = [os.path.join(folder, f) for f in os.listdir(folder) if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")] if tests: st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True, timeout=30).returncode == 0 for t in tests) st_note = f"{len(tests)} test_*.py" elif re.search(r"(?im)^test\s*:", skill_txt):
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # 7 deploy-ready ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py") if os.path.isfile(ci) and os.path.isfile(skill): r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True) all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)") else: all_ok &= axis(True, "deploy-ready (skipped)")
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 70% confidence
- Finding
The script invokes ci_check.py with cwd set to the product folder, which is subprocess execution affecting the local environment. While this is part of CI-oriented behavior, the file lacks a specific warning that verification will execute an additional helper script against the target folder.
- Content