Ascii Art Creator

• Outcome: Pass
• Latest audit: Jul 13, 2026 · 10:53 AM UTC
• Version: 2.0.1

Overview

This is a coherent ASCII-art command-line skill; the risky execution findings are confined to optional CI verification helpers, not the advertised install or runtime path.

Installing the ASCII-art tool is reasonable. Use ascii_art.py for normal banner, box, cow, table, and image conversion tasks. Do not run ci/verify_product.py on repositories or skill folders you do not trust unless it is inside a sandbox with no secrets, because that verifier intentionally executes discovered Python self-tests and test files.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

• Confidence: 97% confidence
• Finding: This helper executes an arbitrary Python file from the target product directory as part of verification (`python <file> self-test`). In a CI or reviewer environment, an untrusted skill author can place malicious code in a `.py` file that performs harmful actions before or instead of handling the `self-test` argument, leading to arbitrary code execution on the host.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

• Confidence: 95% confidence
• Finding: Compiling every discovered `.py` file with `python -m py_compile <file>` causes the Python interpreter to parse attacker-supplied files from the untrusted product. While this is not shell injection, it still processes arbitrary files in the CI environment and can be abused for denial of service via extremely large or pathological inputs; depending on interpreter/toolchain behavior, any parser/compiler bug would also become reachable.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

• Confidence: 98% confidence
• Finding: This executes any `test_*.py` or `*_test.py` file found in the product directory. Because these test files are fully controlled by the skill author, a malicious submission can run arbitrary code during verification, exfiltrate CI secrets, modify files, or attack internal services.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence
• Finding: The skill declares no permissions, yet the associated behavior indicates file-reading and shell execution capabilities. In an agent environment, undeclared execution and filesystem access reduce transparency and can enable unexpected command execution or local data exposure if the skill is invoked automatically or with untrusted inputs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documented purpose is simple ASCII-art generation, but the detected behavior expands into repository verification, subprocess execution, CI/self-test runs, source scanning, and deploy-readiness auditing. This mismatch is dangerous because users or orchestrating agents may grant trust based on the benign description while the skill performs broader actions with shell and file access, increasing the risk of unintended execution and data exposure.

Static analysis

No suspicious patterns detected.