Security audit

Code Executor

Security checks for vulnerabilities and agentic risk

Overview

This skill openly aims to run code, shell commands, local scripts, and package installs, but its authority is very broad and its safety controls are only documented, not implemented in the artifact.

Install only if you intentionally want a skill that can run arbitrary code and shell commands. Use it in a disposable, sandboxed environment with minimal file access, avoid running scripts from sensitive directories, and treat dependency installation as risky unless package versions and sources are controlled.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:22
Finding: Unrestricted Dynamic Code and Command Execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:105
Finding: Unsafe Runtime Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:120
Finding: Documented Security Controls Lack Enforceable Implementation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill says the bot can write and execute code whenever it 'needs to do something that it doesn't have a skill for,' which is an extremely broad activation condition. In a code-execution skill, unclear triggers materially increase the chance of unsafe invocation on ordinary user requests, leading to unintended code generation and execution with filesystem or package-install side effects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Generic verbs like 'solve' and 'compute' overlap heavily with normal conversational requests, so the skill may activate for benign questions that do not imply consent to code execution. In this context, accidental activation is especially dangerous because the skill can generate scripts, run bash, and operate on files, turning ordinary prompts into execution flows.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The manifest description is presented only in Spanish, which can imply a fixed language experience rather than offering the user's preferred language. The file does not indicate that the skill supports language selection or that Spanish is an intentional region-specific constraint.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.