Ai Autotester

• Outcome: Review
• Latest audit: May 29, 2026 at 9:23 PM UTC
• Version:
  1.0.0

Overview

This testing helper matches its stated purpose, but it can change project files, install Python packages, and run project code on the host without clear warning or containment.

Install only if you plan to use it on trusted Python projects and are comfortable with it modifying repository files, installing packages, and running tests on your machine. Prefer using it in a disposable virtual environment or container and review file changes afterward.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

(r1:=t/"requirements.txt").exists() and subprocess.run(["python","-m","pip","install","-q","-r",str(r1)],cwd=str(t),check=False)
(t/"requirements-test.txt").write_text("pytest==8.3.2\nhttpx==0.27.2\n",encoding="utf-8")
subprocess.run(["python","-m","pip","install","-q","-r",str(t/"requirements-test.txt")],cwd=str(t),check=False)
r=subprocess.run(["python","-m","pytest","-q"],cwd=str(t),capture_output=True,text=True)
print(json.dumps({"skill":"AI_AutoTester","status":"ok" if r.returncode==0 else "failed","task":a.task,"target":str(t),"returncode":r.returncode,"stdout":r.stdout[-4000:],"stderr":r.stderr[-2000:],"timestamp":datetime.now(UTC).isoformat().replace("+00:00","Z")},ensure_ascii=False,indent=2))
sys.exit(0 if r.returncode==0 else 2)

• Confidence: 98% confidence
• Finding: r=subprocess.run(["python","-m","pytest","-q"],cwd=str(t),capture_output=True,text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

t.exists() or (print(json.dumps({"skill":"AI_AutoTester","status":"error","error":f"Target path not found: {t}"},ensure_ascii=False,indent=2)),sys.exit(1))
(td:=t/"tests").mkdir(parents=True,exist_ok=True)
(tf:=td/"test_smoke.py").exists() or tf.write_text('from app.main import app\nfrom fastapi.testclient import TestClient\n\ndef test_root():\n c=TestClient(app)\n r=c.get("/")\n assert r.status_code==200\n',encoding="utf-8")
(r1:=t/"requirements.txt").exists() and subprocess.run(["python","-m","pip","install","-q","-r",str(r1)],cwd=str(t),check=False)
(t/"requirements-test.txt").write_text("pytest==8.3.2\nhttpx==0.27.2\n",encoding="utf-8")
subprocess.run(["python","-m","pip","install","-q","-r",str(t/"requirements-test.txt")],cwd=str(t),check=False)
r=subprocess.run(["python","-m","pytest","-q"],cwd=str(t),capture_output=True,text=True)

• Confidence: 99% confidence
• Finding: (r1:=t/"requirements.txt").exists() and subprocess.run(["python","-m","pip","install","-q","-r",str(r1)],cwd=str(t),check=False)

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill is defined with very broad purpose, inputs, and workflow boundaries, but lacks clear trigger scope, allowed actions, and explicit exclusion conditions. In an agent setting, this can enable unintended use on sensitive codebases or tasks, causing the tester agent to perform overly expansive analysis or potentially risky automated actions based on ambiguous task descriptions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill silently installs packages and executes tests without a user-facing warning or consent step, increasing the chance that arbitrary code from the target repository runs unexpectedly. In this context, the absence of disclosure is dangerous because the operations are not merely analytical; they actively execute untrusted code and modify the environment.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill writes test and requirements files into the target project without disclosing that it will modify repository contents. Although file creation is less severe than code execution, undisclosed mutation can tamper with user workspaces, affect later builds, and make subsequent execution less transparent.

VirusTotal

66/66 vendors flagged this skill as clean.