Security audit
Security checks across malware telemetry and agentic risk
This is a real local calculator skill, but its expression parser can execute local shell commands despite claiming that arbitrary code execution is not possible.
Install only if you trust every expression that will be passed to the skill and run it in an isolated environment. The publisher should replace eval with a strict math parser or AST allowlist, remove exposed module/builtin escape paths, add runtime limits, and update the documentation before this is safe for untrusted agent input.
"np": np,
}
try:
result = eval(expr, {"__builtins__": {}}, safe_ns)
return float(result)
except Exception as e:
error_exit("mp": mpmath.mp,
}
try:
result = eval(expr, {"__builtins__": {}}, safe_ns)
return mpmath.nstr(result, precision)
except Exception as e:
error_exit("exp": math.exp,
"abs": abs,
}
return eval(expr_str, {"__builtins__": {}}, ns)
op = args.operation
try:"exp": math.exp,
"abs": abs,
}
return eval(expr_str, {"__builtins__": {}}, ns)
op = args.operation
try:"exp": math.exp,
"abs": abs,
}
return [eval(ode_expr, {"__builtins__": {}}, ns)]
x_span = (bounds[0], bounds[1])
x_eval = [bounds[0] + (bounds[1] - bounds[0]) * i / 20 for i in range(21)]64/64 vendors flagged this skill as clean.
Detected: suspicious.dynamic_code_execution