Python Assistant

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:29 AM UTC
• Version: 1.0.0

Overview

This Python helper is mostly coherent, but one documented refresh path can delete an arbitrary writable folder if the virtual-environment path is misused.

Review before installing. The skill is not showing deception or exfiltration, but only use its recreate command with a clearly project-local .venv path. Avoid passing absolute paths or parent directories to --venv, and prefer a version that validates the target before deleting anything.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/python_env_tool.py:37

Finding

Arbitrary Recursive Directory Deletion via User-Controlled Virtual Environment Path

Content

View full analysis

Vulnerability Details

File Location: scripts/python_env_tool.py, lines 37–40
Vulnerability Type: Unrestricted recursive deletion of a caller-controlled path
Risk Level: High

Vulnerable Code:

python

def cmd_bootstrap(args: argparse.Namespace) -> int:
    venv = Path(args.venv)
    if args.recreate and venv.exists():
        shutil.rmtree(venv)
    if not venv.exists():
        _run([sys.executable, "-m", "venv", str(venv)])

The affected path is supplied through the unrestricted --venv argument at lines 91–92:

python

bootstrap.add_argument("--venv", default=".venv", help="venv path (default: .venv)")
bootstrap.add_argument("--recreate", action="store_true", help="delete and recreate venv")

Technical Analysis

The bootstrap command converts the caller-provided --venv value directly into a Path. If --recreate is present and that path exists, the program passes it to shutil.rmtree() without validating that:

• The path is a virtual environment.
• The path is inside the current project.
• The resolved path is not the project root, user home, or another sensitive directory.
• The path contains a virtual-environment marker such as pyvenv.cfg.
• The user has explicitly confirmed the resolved deletion target.

This creates a destructive path-manipulation vulnerability. An accidental argument or attacker-influenced Agent instruction can select any writable directory for recursive deletion. Argument-list execution in _run() prevents shell injection, but it does not mitigate the unsafe filesystem operation.

Attack Path

1. An attacker-controlled task, prompt, automation input, or operator mistake influences the value passed to --venv.

2. The helper is invoked with both --recreate and a path to a valuable writable directory, for example:

   bash

   scripts/python_env_tool.py bootstrap --recreate --venv /path/to/writable/data
   

3. `Path ...[truncated 833 chars]

Remediation

View remediation

Remediation Suggestions

1. Resolve and normalize both the project root and requested virtual-environment path before any deletion.
2. Require the deletion target to be a strict descendant of the project root; reject the project root itself and all paths outside it.
3. Reject filesystem roots, the current user's home directory, empty paths, . and other sensitive targets.
4. Before deletion, require a recognized virtual-environment marker such as pyvenv.cfg and verify the expected interpreter layout.
5. Consider restricting --recreate to a fixed project-local directory such as .venv rather than accepting arbitrary paths.
6. Display the resolved deletion target and require explicit confirmation for destructive operations, with a separate carefully named noninteractive override for trusted automation.
7. Refuse deletion when validation is ambiguous, including unexpected symlink or path-resolution conditions.
8. Add automated tests covering absolute paths, parent traversal, project-root selection, home-directory selection, filesystem roots, symlinks, and directories that are not virtual environments.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to run shell commands and environment-detection/install workflows, but it does not declare an explicit tool scope such as allowed-tools or permissions. That creates a policy gap where an orchestrator may permit broader command execution than intended, increasing the chance of unauthorized installs, script execution, or environment modification if the skill is invoked in a sensitive context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill enables implicit invocation but does not define a narrowly scoped trigger or constraint on when it should be auto-selected. This can cause the agent to invoke a Python-capable skill in broader contexts than intended, increasing the chance of unnecessary environment changes, dependency installation, or script execution based on ambiguous user input.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/python_env_tool.py (reported line 21)May include surrounding context.

python

def _run(cmd: list[str], cwd: Path | None = None) -> None:
    subprocess.run(cmd, cwd=cwd, check=True)


def cmd_doctor(_: argparse.Namespace) -> int: