statsoft-cli

• Outcome: Review
• Latest audit: Aug 2, 2026 · 12:45 PM UTC
• Version: 2.8.2

Overview

This skill is mostly transparent and purpose-aligned, but it needs Review because some setup flows can run local statistical binaries during verification without the documented verification opt-in.

Review this skill carefully before installing. It is designed to run local statistics programs and user scripts, and that is expected for its purpose, but do not set STATSOFT_AUTO_WRITE or run setup commands in sensitive environments unless you are comfortable with local binary execution, config changes, and possible network installs. Prefer explicit per-action confirmation and trusted workspaces.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"compiled from the user-supplied .stan file (artifacts land outside the "
          "skill directory, inherent to CmdStan).")
    print(f"Building model: {_safe_arg(model_file)}")
    build = subprocess.run([
        "make", "-C", path, model_target
    ], capture_output=True, text=True)
    if build.returncode != 0:

• Confidence: 90% confidence
• Finding: This subprocess call invokes `make` to build a user-supplied Stan model, which results in compilation and subsequent execution of attacker-controlled native code paths. Although the code avoids `shell=True`, uses absolute paths, and requires explicit opt-in, the operation is still a real code-execution sink and is dangerous in an agent skill because a caller can authorize execution and then run untrusted native build logic outside the skill directory.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print("Command: " + " ".join(_safe_arg(a) for a in args))

    try:
        proc = subprocess.run(args, capture_output=True, text=True)
    finally:
        if cleanup_output:
            shutil.rmtree(output_dir, ignore_errors=True)

• Confidence: 96% confidence
• Finding: This subprocess call executes the compiled Stan model binary, which is explicitly untrusted native code derived from user input. The script includes warnings, output sanitization, and authorization gating, but once enabled it still provides a direct path to arbitrary native code execution, which is especially sensitive in an AI-agent automation context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

stanc = os.path.join(path, "bin", "stanc")
    if os.path.isfile(stanc):
        if _verify():
            ver = subprocess.run([stanc, "--version"], capture_output=True, text=True)
            print(f"  stanc: {_sanitize(ver.stdout.strip())[:60]}")
        else:
            print("  stanc: (version hidden; set STATSOFT_VERIFY=1 to query)")

• Confidence: 67% confidence
• Finding: This subprocess call launches the `stanc` binary found via config/environment/common paths in order to query its version. Even though it is gated by `STATSOFT_VERIFY=1` and only passes `--version`, it still executes a third-party binary from a path that may be attacker-controlled, creating a local code-execution risk if an untrusted installation path is accepted.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The skill is presented as an integration assistant, but the body documents materially broader behavior: system-wide software inventory, execution of third-party binaries and user-supplied scripts/models, optional network-enabled installs, and persistent config writes. That mismatch can cause an agent or user to grant trust under incomplete assumptions, increasing the chance of unsafe execution or unintended host disclosure.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The manifest says filesystem access is tightly limited, but the later 'Core Permissions' section states broader local read-write capabilities. Conflicting permission declarations undermine policy enforcement and human review, and may lead an agent to permit writes beyond what the manifest suggests.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The manifest declares network 'off' except with explicit confirmation, while the later 'Core Permissions' section lists network access more generally. This inconsistency can mislead agents and users about whether outbound connections are possible and under what conditions, which matters because the skill can guide or enable software installation from external repositories.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: Broad triggers such as generic references to statistics software can cause this high-risk skill to activate on ordinary analytical conversations, not just explicit requests to run integration tooling. In context, accidental invocation is more dangerous because the skill is capable of host scanning, process execution, and configuration changes once engaged.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.