sausg

• Outcome: Review
• Latest audit: May 28, 2026 · 3:26 PM UTC
• Version: 1.0.1

Overview

This skill appears intended for SAUSG automation, but it can delete broad sets of files by default and runs local programs through shell commands using user-provided paths.

Install only if you trust the local SAUSG installation and understand that running calculations may start local executables and delete files in the selected model directory. Prefer using --no-cleanup, back up project folders first, and avoid model or SAUSG paths from untrusted sources.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

tuple: (returncode, stdout, stderr)
    """
    try:
        result = subprocess.run(
            cmd,
            shell=True,
            capture_output=True,

• Confidence: 98% confidence
• Finding: The helper executes arbitrary shell commands with shell=True, and the command string is a free-form parameter. In this file it is used for directory enumeration and process inspection, but the primitive is generic and unsafe: if any part of the command becomes user-influenced or attacker-controlled, it enables command injection and unexpected shell behavior.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 启动进程
        process = subprocess.Popen(
            cmd,
            shell=True,
            stdout=subprocess.PIPE,

• Confidence: 99% confidence
• Finding: The script launches SAUSAGE.exe through shell=True using a command string that embeds model_path and installation path data. Because model_path and sausg_dir can originate from user input, crafted metacharacters or quoting edge cases on Windows can break out of the intended command and execute arbitrary commands under the user's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except Exception as e:
        # 备用方案：使用系统默认编码
        try:
            result = subprocess.run(
                cmd,
                shell=True,
                capture_output=True

• Confidence: 97% confidence
• Finding: The fallback path repeats the same unsafe pattern by calling subprocess.run with shell=True on a raw command string. This preserves the injection surface even if the first execution branch fails, so the risk is not mitigated by the exception handling.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        # 启动进程
        process = subprocess.Popen(
            cmd,
            shell=True,
            stdout=subprocess.PIPE,

• Confidence: 98% confidence
• Finding: The process launch builds a shell command string from user-influenced values and executes it with shell=True. The model path is only checked for existence and .ssg suffix, and the installation directory can also be user-specified, so crafted input containing shell metacharacters or quoting tricks on Windows could break out of the intended command and execute arbitrary commands.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises shell execution and file-reading behavior through example commands and operational guidance, but it does not declare any permissions or trust boundaries. This can cause the agent or reviewer to underestimate the skill's ability to access local files and launch executables, increasing the chance of unintended command execution against user-supplied paths.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill is presented as an automation and result-reading tool, but it performs destructive cleanup in the model directory by default before calculation. That hidden side effect can erase prior results or unrelated working artifacts, making the capability significantly more dangerous than the stated purpose suggests.

Description-Behavior Mismatch

Medium

• Confidence: 99% confidence
• Finding: The cleanup list includes broad, generic extensions like .TXT, .DAT, .CSV, .jpg, and .png for any file in the model directory, not just files generated by SAUSG. In a real project directory this can destroy user notes, datasets, plots, and documentation unrelated to the computation.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: For an analysis/result-reading skill, invoking arbitrary shell commands for directory search and process inspection is broader than necessary and expands the attack surface. The context makes this more dangerous because the skill already accepts user-supplied paths and is intended to run on end-user systems with local file access.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The skill description contains broad activation criteria covering many generic engineering tasks and multiple product names, which can cause the skill to trigger outside a narrowly intended context. Over-triggering is dangerous here because the skill's documented behavior includes opening local models, running calculations, and reading result files via shell commands.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The natural-language trigger phrases are ambiguous and include generic terms like nonlinear analysis, seismic isolation, strengthening, steel analysis, and viewing results, any of which may appear in ordinary discussion rather than an instruction to operate software. Because this skill is designed to invoke scripts and interact with local files, ambiguous matching raises the risk of unintended activation and unsafe actions on the wrong project or path.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: Destructive cleanup is enabled by default and runs before calculation without explicit user confirmation. In a local engineering workflow this can cause immediate, irreversible loss of files and result directories, especially since users may expect a compute tool to be non-destructive.

Static analysis

No suspicious patterns detected.