Security audit

Math Expression

Security checks for vulnerabilities and agentic risk

Overview

This math skill is coherent in purpose, but its Wolfram expression evaluator can expose local file, process, and network capabilities through an incomplete safety gate.

Review this skill before installing. Use it only in an isolated environment with no sensitive files, credentials, or unrestricted network access available to WolframKernel, and do not expose --allow-unsafe to ordinary user requests. Prefer a version with structural allowlist validation and pinned dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/eval_expression.py:121
Finding: Textual denylist bypass permits unrestricted WolframKernel operations
Content: View full analysis
list[str]: hits: list[str] = [] for symbol in UNSAFE_SYMBOLS: pattern = rf"(? ResultPayload: if not args.allow_unsafe: blocked = find_unsafe_symbols(args.expr) if blocked: blocked_text = ", ".join(sorted(set(blocked))) raise EvaluationError( "Expression blocked by safety policy (unsafe symbols detected): " f"{blocked_text}. Use --allow-unsafe only in an isolated environment." ) ``` The accepted expression is then passed directly to a full WolframKernel: ```python with WolframLanguageSession(kernel=kernel) as session: version = evaluate_with_timeout(session, wlexpr("$Version"), args.timeout) exact_value = evaluate_with_timeout(session, wlexpr(args.expr), args.timeout) failed_exact = evaluate_with_timeout( session, wl.SameQ(exact_value, wlexpr("$Failed")), args.timeout, ) if bool(failed_exact): raise EvaluationError("Exact evaluation returned $Failed (invalid expression or runtime error).") numeric_value = evaluate_with_timeout( session, wl.N(wlexpr(args.expr), args.precision), args.timeout, ) ``` ### Technical Analysis The safety mechanism scans raw source text for a finite list of literal dangerous symbol names. This is not a reliable security ...[truncated 2673 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: SKILL.md:48
Finding: Unpinned third-party dependency installation reduces supply-chain integrity
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 89% confidence
Finding: The README documents an option to disable the default blocking of dangerous Wolfram symbols via --allow-unsafe. In a skill that evaluates user-supplied mathematical expressions through Wolfram Engine, this materially increases the risk of command execution, network access, or file I/O if the flag is used in production or exposed to untrusted input, especially given the listed symbols include Run, StartProcess, Import, and URLRead.
Content: Scanner excerpt · README.md (reported line 79)May include surrounding context.
md
- `URLRead`, `URLExecute` - `Run`, `RunProcess`, `StartProcess` 如需在隔离环境中解除限制，可使用 `--allow-unsafe`。 ## 依赖

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: The script exposes a user-selectable --allow-unsafe switch that disables the only built-in guard preventing evaluation of Wolfram Language symbols associated with filesystem, network, and process execution. In an agent skill that evaluates user-supplied expressions, this creates a straightforward path to arbitrary side effects or command execution if the flag is enabled by the calling system or accidentally propagated from user control.
Content: Scanner excerpt · scripts/eval_expression.py (reported line 104)May include surrounding context.
python
help="Skip exact-vs-numeric consistency verification", ) parser.add_argument( "--allow-unsafe", action="store_true", help=( "Allow expressions containing filesystem/network/process symbols "

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: This code explicitly instructs operators to bypass the safety policy with --allow-unsafe, confirming that dangerous expressions can be evaluated when the flag is present. Because the tool is designed to process attacker-controlled math expressions, the override materially weakens the trust boundary and can enable file access, network calls, or subprocess execution inside the Wolfram kernel.
Content: Scanner excerpt · scripts/eval_expression.py (reported line 204)May include surrounding context.
python
blocked_text = ", ".join(sorted(set(blocked))) raise EvaluationError( "Expression blocked by safety policy (unsafe symbols detected): " f"{blocked_text}. Use --allow-unsafe only in an isolated environment." ) kernel = shutil.which("WolframKernel")

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill description is written as an instruction in Chinese ('使用 Wolfram Engine...') and the document does not indicate that users may interact in other languages or choose a locale. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the constraint is documented and justified.
Content: No source excerpt is available for this finding.