Security audit

Math Utils Native

Security checks for vulnerabilities and agentic risk

Overview

This calculator skill is simple in purpose, but it evaluates user-provided math by inserting it directly into local shell, Python, or PowerShell commands, which can allow arbitrary command execution.

Do not install this version unless you fully trust every expression passed to it and accept host command execution risk. It should be rewritten to use a safe in-process math parser or strict arithmetic grammar, with no shell/interpreter string construction from user input.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: main.js:20
Finding: Arbitrary Command and Code Execution Through Unsanitized Mathematical Expressions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The function interpolates untrusted expression input directly into shell and interpreter command strings passed to execSync. An attacker can supply shell metacharacters or language payloads to execute arbitrary OS commands on Linux, macOS, or Windows, making this a direct command injection / arbitrary code execution issue.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly states it will execute local OS CLI tools such as bc, python3, or PowerShell on the host, but it does not warn users that their input will be turned into commands executed in the local environment. That omission is dangerous because mathematical expressions are untrusted input, and if command construction is not strictly sandboxed and escaped, it can lead to command injection or unsafe host interaction while users may not realize the trust boundary they are crossing.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The comments describe the feature as a calculator, but the implementation actually constructs OS shell, Python, and PowerShell commands from user input. This mismatch is dangerous because it hides a code-execution capability behind a benign description, increasing the chance that reviewers or users will trust and invoke unsafe behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The exported calculate path executes user-supplied expressions in subprocesses without any warning, confirmation, or safety gate. In skill/plugin contexts this increases risk because consumers may pass seemingly harmless math input while unknowingly triggering arbitrary command execution on the host.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The user-facing natural-language description and usage instructions are written in Chinese, with no indication that language choice is optional or that the skill is region-specific. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file's user-visible natural language is entirely in Chinese, including comments describing behavior and the runtime error message returned to callers. There is no indication that language selection is optional or justified by a region-specific constraint, so this may violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: main.js:20