Code Runner Tool Free

• Outcome: Review
• Latest audit: Jul 22, 2026 · 1:43 PM UTC
• Version: 1.0.0

Overview

This skill is a code-running helper, but it combines automatic prompt approval, file sync-back, external LLM use, and sudo/root guidance in a way users should review carefully.

Install only if you are comfortable with a skill that can run code tasks over your project, send prompts or project context to an external LLM-backed CLI, auto-answer confirmations, and sync modified files back. Use a least-privilege account, avoid sudo/root for task execution, keep backups or require diff review before sync-back, and protect or rotate any API key used for automation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly depends on an external code CLI and LLM API connectivity, which expands the trust boundary beyond local PTY execution and file sync into remote processing of prompts, code, and possibly project data. In a code-execution skill, this can expose sensitive source files or credentials to external services if users assume the tool is purely local.

Scope Creep

High

• Confidence: 96% confidence
• Finding: The manifest declares only read and exec, but the documented workflow includes copying projects, changing ownership, synchronizing modified files back, and deleting temporary files. This mismatch can mislead policy engines or users about the skill's real write/destructive capabilities, increasing the chance of unauthorized file modification or privilege-impacting operations.

Missing User Warnings

High

• Confidence: 93% confidence
• Finding: Advertising automatic confirmation handling without an explicit safety boundary encourages unattended acceptance of prompts during execution. In a PTY-backed code runner, confirmations may include package installs, file overwrites, privilege escalations, network actions, or destructive shell operations, so blind acceptance materially raises the risk of unsafe execution.

Missing User Warnings

High

• Confidence: 90% confidence
• Finding: The skill states that project files are copied to a temporary directory and synchronized back, but does not clearly warn that sync-back can overwrite source files or propagate unintended modifications. In a code-generation/execution workflow, that can silently replace user code, tests, configs, or secrets with AI-produced or tool-produced changes.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: The documented execution flow includes ownership changes, execution, synchronization, and cleanup, all of which can have privileged or destructive side effects. Without strong user-facing warnings and safeguards, a user may unknowingly authorize chown, file replacement, or deletion operations that alter system state beyond the intended task.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The sample auto-response logic unconditionally sends 'y' to generic prompts such as 'Are you sure' and 'Continue?', which is a classic unsafe-automation pattern. Because many dangerous commands intentionally use those exact confirmations before overwriting files, deleting data, or performing system-wide changes, this can convert warnings into automatic approval.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The documentation advises running the tool with root or sudo to overcome permission issues, but does not emphasize the severe risk of combining elevated privileges with LLM-driven code execution and automatic prompt acceptance. This substantially increases blast radius: any mistaken or malicious command can modify protected files, install software, or change system configuration.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The documentation instructs users to provide an API key in environment variables for automated usage but omits warnings about credential leakage through logs, subprocess environments, crash dumps, or inherited child processes. In an execution tool that launches commands and captures output, exposed secrets may be inadvertently printed, persisted, or transmitted.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

sudo useradd -m -s /bin/bash code-runner

# 已知限制
sudo chown -R code-runner:code-runner /path/to/projects

# 使用该用户执行
export CODE_RUNNER_USER="code-runner"

• Confidence: 83% confidence
• Finding: sudo

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.