ClawHub
Back to skill

Security audit

Python Executor

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned for sandboxed Python execution, but its documented installation path asks users to run mutable remote code directly in a shell.

Review before installing. The Python execution feature is coherent, but do not run the curl-to-shell quick start unless you trust inference.sh's installer delivery path. Prefer a separately downloaded, inspected, and verified CLI installer, and avoid sending secrets or private data through executed Python code unless you intend that code to contact external services.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:16
Finding

Unverified Remote Installer Executed Directly by Shell

Content
View full analysis
Remediation
View remediation
/infsh- curl -fSLO https://dist.inference.sh/cli//checksums.txt sha256sum --check checksums.txt --ignore-missing install -m 0755 infsh- "$HOME/.local/bin/infsh" infsh login ``` - Ensure the real artifact URL, filename, and verification procedure are documented precisely. - Avoid requesting elevated privileges and install into a user-controlled directory unless system-wide installation is explicitly necessary. - Sign release artifacts and document signature verification using a pinned public key. - Keep installation and authentication as separate operations so users can verify the installed executable before providing credentials. ]]>

T08 · Insecure Dependencies

Warning
Location
SKILL.md:168
Finding

Related Skill Installation Commands Use Unpinned Remote Sources

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The quick-start instructs users to pipe a remotely fetched script directly into sh, which executes unreviewed code from the network immediately. Even with claims about checksum verification, this pattern is dangerous because it prevents local inspection and creates a single-step remote code execution path if the distribution channel or hosting is compromised.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Quick Start

bash
curl -fsSL https://cli.inference.sh | sh && infsh login

# Run Python code
infsh app run infsh/python-executor --input '{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest description includes very broad triggers such as python, execute code, automation, and API calls, which can match many common user requests and cause this high-risk skill to be selected too often. Because the skill executes arbitrary Python and advertises network-capable libraries, overbroad routing increases the chance of unnecessary code execution and data-handling exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description promotes web scraping, API calls, and automation but does not warn that user-provided code may make outbound network requests or transmit data externally. In a code-execution skill, that omission can mislead users and agents into sending sensitive inputs, cookies, tokens, or derived data to third-party services.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

bash
infsh app run infsh/python-executor --input '{
  "code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octocat\")\ndata = response.json()\nprint(json.dumps(data, indent=2))"
}'

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill recommends invoking npx skills add ... without pinning an exact package/version, which allows whatever version is current at execution time to be fetched and run. That creates a supply-chain risk if the upstream package is compromised or a breaking/malicious update is published.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

This example also uses unpinned npx skills, causing dynamic retrieval and execution of the latest package version. In agent/tooling contexts, that undermines reproducibility and can expose users to malicious or tampered package updates.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

A third unpinned npx skills invocation repeats the same package-resolution risk: code from the registry is executed without a fixed version constraint. This is especially risky in documentation because users may copy-paste it directly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.