skill-python-env

• Outcome: Review
• Latest audit: May 29, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but it automatically runs remote installer code and lets other skills change a shared Python environment, so it needs careful review before use.

Install only if you trust every skill that can call it and are comfortable with automatic software installation from the network. Safer operation would preinstall uv through an approved channel, restrict or pin package names, and treat ~/.python_env/<version> as shared mutable state that can affect multiple skills.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

if not packages:
        return
    log_info(f"安装依赖包：{' '.join(packages)}")
    result = subprocess.run(
        [uv_path, "pip", "install", "--python", str(env_dir), *packages],
        check=False,
    )

• Confidence: 94% confidence
• Finding: The script accepts arbitrary package names from callers and installs them into a shared environment reused by multiple skills. This creates a cross-skill supply-chain and environment-poisoning risk: one skill can add malicious or conflicting packages that later affect other skills using the same shared interpreter.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

log_error("  https://docs.astral.sh/uv/getting-started/installation/")
            sys.exit(1)
        log_info("使用 PowerShell 安装 uv...")
        result = subprocess.run(
            [ps, "-ExecutionPolicy", "ByPass", "-Command",
             "irm https://astral.sh/uv/install.ps1 | iex"],
            check=False,

• Confidence: 99% confidence
• Finding: This executes a remote PowerShell installer directly from the network using irm ... | iex, which is effectively remote code execution without integrity verification or user confirmation. Any compromise of the upstream host, transport, or installation path would lead to arbitrary code execution on the host running the skill.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

wget = shutil.which("wget")
        if curl:
            log_info("使用 curl 安装 uv...")
            proc = subprocess.run([curl, "-LsSf", "https://astral.sh/uv/install.sh"],
                                  stdout=subprocess.PIPE, check=True)
            subprocess.run(["sh"], input=proc.stdout, check=True)
        elif wget:

• Confidence: 98% confidence
• Finding: Fetching a shell installer from a remote URL is the first half of a pipe-to-shell pattern and directly enables execution of untrusted remote content. Even though the fetch itself is separate, in this context it feeds the installer bytes to sh and therefore participates in a remote code execution path.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

log_info("使用 curl 安装 uv...")
            proc = subprocess.run([curl, "-LsSf", "https://astral.sh/uv/install.sh"],
                                  stdout=subprocess.PIPE, check=True)
            subprocess.run(["sh"], input=proc.stdout, check=True)
        elif wget:
            log_info("使用 wget 安装 uv...")
            proc = subprocess.run([wget, "-qO-", "https://astral.sh/uv/install.sh"],

• Confidence: 99% confidence
• Finding: This runs shell code received from the network via stdin to sh, making the host trust and execute unauthenticated remote script content. In an internal automation skill, this is especially dangerous because it may run unattended and with the invoking agent's privileges.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.run(["sh"], input=proc.stdout, check=True)
        elif wget:
            log_info("使用 wget 安装 uv...")
            proc = subprocess.run([wget, "-qO-", "https://astral.sh/uv/install.sh"],
                                  stdout=subprocess.PIPE, check=True)
            subprocess.run(["sh"], input=proc.stdout, check=True)
        else:

• Confidence: 98% confidence
• Finding: Like the curl branch, this downloads a remote install script intended for immediate execution, creating a remote code execution chain with no integrity validation. The fact that wget is used instead of curl does not reduce the underlying trust problem.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

log_info("使用 wget 安装 uv...")
            proc = subprocess.run([wget, "-qO-", "https://astral.sh/uv/install.sh"],
                                  stdout=subprocess.PIPE, check=True)
            subprocess.run(["sh"], input=proc.stdout, check=True)
        else:
            log_error("未找到 curl 或 wget，请手动安装 uv：")
            log_error("  https://docs.astral.sh/uv/getting-started/installation/")

• Confidence: 99% confidence
• Finding: Executing network-fetched script content with sh is a classic unsafe bootstrap pattern. If the installer URL or upstream distribution is compromised, arbitrary commands will run immediately on the machine hosting the skill.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly performs shell execution, environment manipulation, and network-based installation of uv/Python, yet declares no required permissions. This creates a trust and policy gap: callers or reviewers may treat it as low-risk while it can modify the host, download executables, and change shared runtime state.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill is described as shared Python environment management, but it also mutates the shared environment by installing caller-specified packages. In this context, shared mutable dependencies are dangerous because they let one skill influence the runtime of unrelated skills, enabling dependency confusion, malicious package persistence, or breaking changes across consumers.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The script automatically installs uv by downloading and executing remote installer scripts without user confirmation, signature verification, or checksum validation. Because this is an internal utility likely run non-interactively by other skills, it expands the blast radius from a convenience feature into unattended remote code execution during setup.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script automatically downloads and executes a remote installer for uv via PowerShell or shell piping without verifying integrity, pinning a version, or requiring explicit user confirmation. This creates a direct supply-chain and remote-code-execution risk: if the upstream host, network path, or installer content is compromised, arbitrary code will run with the user's privileges.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.