ClawHub
Back to skill

Security audit

calculator-py

Security checks across malware telemetry and agentic risk

Overview

This is a real local calculator skill, but its expression parser can execute local shell commands despite claiming that arbitrary code execution is not possible.

Install only if you trust every expression that will be passed to the skill and run it in an isolated environment. The publisher should replace eval with a strict math parser or AST allowlist, remove exposed module/builtin escape paths, add runtime limits, and update the documentation before this is safe for untrusted agent input.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

eval() call detected

High
Category
Dangerous Code Execution
Content
"np": np,
    }
    try:
        result = eval(expr, {"__builtins__": {}}, safe_ns)
        return float(result)
    except Exception as e:
        error_exit(
Confidence
95% confidence
Finding
This evaluates untrusted user input with Python eval(). Although __builtins__ is removed and a restricted namespace is provided, exposing the numpy module as np still gives attackers a large object graph that can often be abused for sandbox escape, introspection, file access through imported modules, or denial-of-service via expensive expressions. In an agent skill that may receive arbitrary model-composed expressions, this is especially risky.

eval() call detected

High
Category
Dangerous Code Execution
Content
"mp": mpmath.mp,
    }
    try:
        result = eval(expr, {"__builtins__": {}}, safe_ns)
        return mpmath.nstr(result, precision)
    except Exception as e:
        error_exit(
Confidence
94% confidence
Finding
This is another direct eval() on attacker-controlled input, here with mpmath symbols available. Even with builtins disabled, eval on arbitrary expressions is unsafe because Python object traversal and library surface can enable sandbox bypasses or resource exhaustion; mpmath also permits extremely expensive computations that can hang the process. Since this skill is intended for agent use, the expression source should be treated as untrusted.

eval() call detected

High
Category
Dangerous Code Execution
Content
"exp": math.exp,
            "abs": abs,
        }
        return eval(expr_str, {"__builtins__": {}}, ns)

    op = args.operation
    try:
Confidence
93% confidence
Finding
The optimization callback evaluates a user-supplied expression repeatedly via eval(). This compounds the danger: a malicious payload may achieve code execution if the sandbox is bypassed, and even without escape it can trigger severe CPU consumption because optimization routines invoke the function many times. The agent-facing calculator context increases exposure because expressions are expected to come from external prompts or model-generated content.

eval() call detected

High
Category
Dangerous Code Execution
Content
"exp": math.exp,
            "abs": abs,
        }
        return eval(expr_str, {"__builtins__": {}}, ns)

    op = args.operation
    try:
Confidence
93% confidence
Finding
This integrates a user-provided expression by calling eval() for each sampled point. As with the optimizer path, repeated evaluation magnifies both sandbox-escape risk and denial-of-service potential through pathological expressions or intentionally unstable functions. In a local tool used by agents, this creates a dangerous bridge from natural-language input to executable Python semantics.

eval() call detected

High
Category
Dangerous Code Execution
Content
"exp": math.exp,
                    "abs": abs,
                }
                return [eval(ode_expr, {"__builtins__": {}}, ns)]

            x_span = (bounds[0], bounds[1])
            x_eval = [bounds[0] + (bounds[1] - bounds[0]) * i / 20 for i in range(21)]
Confidence
93% confidence
Finding
The ODE solver evaluates attacker-controlled expressions with eval() during repeated solver callbacks. This presents the same code-execution and sandbox-bypass concerns as other eval sites, plus amplified denial-of-service risk because the solver may invoke the function many times and on adaptive step sizes. In an agent skill intended to process arbitrary tasks, this is a genuine unsafe execution sink.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical
Code
suspicious.dynamic_code_execution
Location
scripts/calc.py:78