代码执行工具免费版

• Outcome: Review
• Latest audit: Aug 28, 2026 · 3:54 PM UTC
• Version: 1.0.3

Overview

This skill runs automated coding tasks with command execution, auto-confirmation, file write-back, and sudo guidance, while overstating safety controls.

Install only if you intentionally want an agent to run coding commands and modify projects. Use it in an isolated disposable workspace, avoid sudo/root, review diffs before keeping changes, and do not expose sensitive repositories or API keys unless you trust the external CLI and execution environment.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (8)

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The document claims the tool only executes whitelisted commands, but the rest of the skill explicitly supports arbitrary natural-language programming tasks routed through an execution tool and external code CLI. This mismatch can mislead users and downstream agents into trusting unsafe execution boundaries that do not actually exist, increasing the chance of unsafe command execution or policy bypass.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill advertises command execution in a 'safe sandbox', but other sections require root/sudo, ownership changes, PTY execution, and syncing modifications back to the original directory. That is not a confined sandbox, and the false assurance could cause users to run high-risk tasks under the mistaken belief that host integrity is protected.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The invocation language is very broad and overlaps with common software-development requests, making it easy for an agent to select this skill for routine prompts without the user realizing it triggers code execution. In the context of a skill that can execute commands, auto-answer prompts, and write changes back to disk, overbroad routing materially increases accidental high-risk use.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The example trigger phrase '执行核心功能' is vague and provides no indication that the skill may execute commands or alter project files. Such underspecified activation text can cause unintended invocation of a powerful execution skill in contexts where the user did not meaningfully consent to destructive or privileged actions.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill automatically answers confirmation prompts with 'y', but this behavior is not prominently disclosed in the top-level description. In a code-execution context, auto-confirmation can approve package installs, overwrites, destructive file operations, or security-sensitive trust prompts that a human would otherwise stop and review.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The documentation describes syncing changes from a temporary directory back to the original project, but this side effect is not clearly highlighted as a primary risk. For a tool that executes arbitrary coding tasks, silent write-back can persist malicious, erroneous, or destructive modifications into the real workspace without sufficient user awareness.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill recommends privileged execution to resolve permission issues, but does not place an equally prominent warning on the risks of running LLM-directed code with sudo/root. In this context, elevated execution magnifies any mistake, prompt injection, dependency compromise, or unintended command into host-level damage.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo useradd -m -s /bin/sh code-runner

# 已知限制
sudo chown -R code-runner:code-runner /path/to/projects

# 使用该用户执行
export CODE_RUNNER_USER="code-runner"

• Confidence: 91% confidence
• Finding: The documentation includes sudo-based setup and ownership changes for the execution environment. In isolation this is administrative guidance, but in a skill centered on automated code execution and file synchronization, normalized use of sudo materially increases the blast radius of misuse or compromise.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.