Python Exec

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.1

Overview

This skill is disclosed as a document-creation helper, but it exposes an unrestricted local Python execution command that is broader than that purpose.

Install only if you intentionally want a moderator-approved local Python execution helper and will review exactly what code is run. Prefer a skill that accepts structured document content and writes only to chosen output files if you only need Word, Excel, or PowerPoint generation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.json:2

Finding

Unrestricted Local Python Code Execution Exceeds the Document-Creation Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.json, lines 2-8
Vulnerability Type: Arbitrary local code execution through an unrestricted command argument
Risk Level: High

Vulnerable Code

json

"name": "python-exec",
"description": "Executes Python code locally via PowerShell",
"commands": {
  "run": {
    "arguments": {
      "code": "string"
    }
  }
}

Technical Analysis

The run command accepts a generic string named code, while the skill description states that the supplied Python code is executed locally through PowerShell. No command schema, operation allowlist, module restriction, path constraint, sandbox requirement, or input validation is declared.

This interface exposes substantially more capability than the Office-document creation purpose documented in SKILL.md. Python code is not limited to python-docx, openpyxl, or python-pptx; it can use standard-library functions such as file operations, subprocess creation, environment inspection, and network access where permitted by the host.

The package does not include the command implementation, so implementation-specific safeguards cannot be verified. Nevertheless, the declared unrestricted source-code interface itself creates an unsafe execution boundary: if untrusted or attacker-influenced content reaches run.code, it may be interpreted as executable Python rather than document data.

Attack Path

1. An attacker supplies content that influences or controls the code argument passed to the skill's run command.
2. The Agent invokes run while processing a document-generation request.
3. The skill passes the unrestricted string to local Python execution through PowerShell, as declared in SKILL.json.
4. The Python payload performs operations unrelated to document creation, such as reading or modifying files, inspecting environment variables, starting subprocesses, or initiating network requests.
5. Thos ...[truncated 1035 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the generic code argument and replace it with narrowly scoped operations such as create_word_document, create_spreadsheet, and create_presentation.
2. Accept validated structured data rather than executable source code. Define strict schemas for document content, output format, and formatting options.
3. Restrict output paths to a dedicated workspace. Canonicalize paths and reject absolute paths and traversal sequences.
4. If generic Python execution is an intentional requirement, run it in an isolated sandbox with:
   • A non-privileged, disposable operating-system identity.
   • Read-only or explicitly allowlisted filesystem mounts.
   • Network access disabled by default.
   • Process, CPU, memory, execution-time, and output-size limits.
   • Subprocess and dangerous module restrictions.
   • No inherited secrets, credentials, or sensitive environment variables.
5. Require explicit, informed user approval immediately before executing arbitrary code, showing the exact code and requested capabilities.
6. Add authorization checks and audit logging for each execution, including the caller, code digest, approved capabilities, output paths, and result.
7. Include the actual execution implementation in the reviewable package so that quoting, PowerShell invocation, sandboxing, and validation controls can be audited.
8. Keep the moderator-approval requirement documented in SKILL.md, but do not treat approval alone as a substitute for technical isolation and least privilege.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.