Safe Tool Executor

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.0

Overview

The skill does not appear to steal data or run destructive commands, but it overstates its safety protections and has unexplained high-impact capability metadata.

Review before installing. Do not rely on this skill as a real protection layer for destructive or privileged commands unless the approval, blocking, argument validation, and fail-closed behavior are implemented and tested. Also resolve the unexplained wallet, transaction-signing, and sensitive-credential metadata before using it in any sensitive environment.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

def classify_tool(self, tool_name):
        for tier_name, tools in TOOL_TIERS.items():
            if tool_name in tools:
                return getattr(ToolTier, tier_name)
        return ToolTier.READ_ONLY  # Default to safest
    
    def execute(self, tool_name, args):

• Confidence: 50% confidence
• Finding: return getattr(ToolTier, tier_name)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: This is a mismatch because the description promises an enforcement mechanism for least-privilege tool execution and human approval safeguards, but the implementation is only a lightweight classifier/demo. The execute() method does not execute any tool, block dangerous operations, validate arguments, enforce access control, or obtain human approval; it simply returns a status object. While there is no obvious hidden behavior beyond the description, the primary purpose implemented by the code differs materially from the declared purpose, which is enough to flag a mismatch.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest trigger list includes generic phrases such as "tool execution," "dangerous command," and "human approval" without any scoping or exclusion rules. In a markdown/manifest context, these broad phrases could match common discussion rather than intentional invocation, increasing the risk of unintended activation.

Credential Access

High

• Category: Privilege Escalation

Content

executor = SafeToolExecutor()

# READ_ONLY tool - OK directly
result = executor.execute('cat', '/etc/passwd')

# WRITE tool - Warning
result = executor.execute('write', '/project/config.py')

• Confidence: 60% confidence
• Finding: /etc/passwd

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

'READ_ONLY': ['ls', 'cat', 'head', 'tail', 'grep', 'find', 'pwd'],
    'WRITE': ['write', 'edit', 'mkdir', 'touch', 'cp'],
    'DELETE': ['rm', 'rmdir', 'unlink'],
    'DANGEROUS': ['curl|sh', 'sudo', 'chmod 777', 'shutdown']
}

• Confidence: 80% confidence
• Finding: chmod 777

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Pattern | Action |
|---------|--------|
| `rm -rf /*` | BLOCK + ALERT |
| `DROP TABLE` | APPROVAL REQUIRED |
| `TRUNCATE` | APPROVAL REQUIRED |
| `DELETE /system` | APPROVAL + LOG |

• Confidence: 90% confidence
• Finding: rm -rf /

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

result = executor.execute('write', '/project/config.py')

# DELETE tool - BLOCKED without approval
result = executor.execute('rm', '/important/file.txt')
# → BLOCKED: requires human approval
```

• Confidence: 85% confidence
• Finding: rm', '/important/

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| Pattern | Action |
|---------|--------|
| `rm -rf /*` | BLOCK + ALERT |
| `DROP TABLE` | APPROVAL REQUIRED |
| `TRUNCATE` | APPROVAL REQUIRED |
| `DELETE /system` | APPROVAL + LOG |

• Confidence: 85% confidence
• Finding: rm -rf /

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| `rm -rf /*` | BLOCK + ALERT |
| `DROP TABLE` | APPROVAL REQUIRED |
| `TRUNCATE` | APPROVAL REQUIRED |
| `DELETE /system` | APPROVAL + LOG |
| `format` | COMPLETE BLOCK |

## Prerequisites

• Confidence: 80% confidence
• Finding: DELETE /system`

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

'READ_ONLY': ['ls', 'cat', 'head', 'tail', 'grep', 'find', 'pwd'],
    'WRITE': ['write', 'edit', 'mkdir', 'touch', 'cp'],
    'DELETE': ['rm', 'rmdir', 'unlink'],
    'DANGEROUS': ['curl|sh', 'sudo', 'chmod 777', 'shutdown']
}

• Confidence: 90% confidence
• Finding: chmod 777

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.