calculator-py

• Analyzed: May 10, 2026, 6:41 AM
• Findings: 1
• Version: 1.0.0
• Hash: 7dce60dabccd98c08625aa8b7f2d707d9058ec6b025b33839f22752a9dd4e692
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill implements a calculator using the Python `eval()` function in `scripts/calc.py` to process user-provided mathematical expressions. While it attempts to sandbox the execution by clearing `__builtins__`, this is a known insecure pattern in Python that is susceptible to Remote Code Execution (RCE) through object introspection and attribute access. The inclusion of the `numpy` and `mpmath` modules in the evaluation namespace further increases the attack surface for escaping the restricted environment.