代码执行工具专业版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.2

Overview

This is a code-execution skill whose main purpose is disclosed, but it asks for broad, high-impact authority with unsafe defaults around admin privileges, automatic confirmations, credentials, dependencies, and retained logs.

Review carefully before installing. Use only in an isolated, trusted workspace or container, avoid root or sudo, do not set EXEC_PASSWORD for generic PTY automation, pin and verify dependencies, and disable or tightly protect audit logs that capture command output.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:294

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:294, SKILL.md:380, and SKILL.md:383
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies
Risk Level: Medium

Evidence

bash

pip install code-runner-pro

bash

npm install -g @anthropic-ai/claude-code
pip install psutil

Technical Analysis

The installation instructions do not pin exact package versions, verify package hashes, or use a committed dependency lockfile. Consequently, the code installed and executed may change without any corresponding change to the reviewed Skill.

The code-runner-pro dependency supplies the core execution behavior advertised by the Skill, but its source code is not included in the audited artifact. Its handling of prompts, commands, credentials, isolation, and audit data therefore cannot be verified from this project.

Global installation of the npm package increases the potential impact because it may expose the package to a broader execution context and can replace an existing command available to multiple projects.

Attack Path

1. An attacker compromises a dependency publisher account, package registry, or a transitive dependency.
2. The attacker publishes a malicious release under one of the referenced package names.
3. A user follows the documented installation commands without a version or integrity constraint.
4. The package manager resolves and installs the attacker-controlled release.
5. Installation hooks or subsequently invoked package functionality execute malicious code with the privileges of the user running the installation.
6. If the installation or runner is invoked with the separately documented root or sudo permissions, the compromise may extend to the entire host.

Impact Assessment

Successful exploitation permits code execution with the privileges of the installer or runner account. Potential effects include repository modification, sour ...[truncated 207 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to an audited exact version.
2. Use committed lockfiles and require cryptographic hash verification where supported.
3. Include the source of the core runner in the reviewed artifact or provide a reproducible build and verifiable source reference.
4. Avoid global package installation; install dependencies in an isolated virtual environment or container.
5. Disable package installation scripts unless they are explicitly required and audited.
6. Continuously scan direct and transitive dependencies for known vulnerabilities and unexpected ownership changes.
7. Document the verified package publisher, registry, expected package hashes, and upgrade-review process.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:376

Finding

Unnecessary Root or Sudo Execution Requirement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:376, SKILL.md:426, and SKILL.md:462
Vulnerability Type: Excessive privileges and unsafe administrative fallback
Risk Level: High

Evidence

text

Permissions: root or sudo (required for user switching)

text

Insufficient permissions: check file permissions and run as administrator.

Technical Analysis

The Skill describes root or sudo access as an environmental requirement and recommends administrative execution when permission errors occur. Batch repository processing, testing, logging, and most user switching scenarios do not inherently require unrestricted root access.

This violates least-privilege principles. The Skill also processes natural-language task descriptions, invokes external execution tooling, and operates on arbitrary working directories. Elevating this execution chain means that a malicious repository, prompt, package, or generated command can act outside the intended project boundary.

Advising users to run as administrator also conceals underlying ownership and access-control problems rather than correcting them with narrowly scoped permissions.

Attack Path

1. An attacker controls or influences a repository, task prompt, dependency, test script, or build configuration processed by the runner.
2. The operator follows the documented requirement and starts the runner with root, sudo, or administrator privileges.
3. The attacker-controlled task causes the runner to invoke a malicious command or project lifecycle hook.
4. The command executes with elevated privileges rather than a restricted project account.
5. The command reads protected files, modifies system configuration, accesses other users' data, or installs persistent components.

Impact Assessment

Exploitation can provide root-level or administrator-level access to the host. This may permit access to system credentials, other users' files, CI secre ...[truncated 283 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove root and sudo from the default requirements.
2. Run tasks under a dedicated, unprivileged service account with access limited to the selected workspace.
3. Execute each task in an isolated container or sandbox with a read-only base filesystem, restricted capabilities, resource limits, and controlled network access.
4. Mount only the required project directories and deny access to host credentials, sockets, home directories, and system paths.
5. If user switching is essential, use a narrowly scoped privileged helper with a fixed command allowlist rather than granting general sudo access.
6. Replace the “run as administrator” fallback with guidance to repair ownership and grant only the minimum required file permissions.
7. Reject working directories outside an explicitly configured allowlist and resolve symbolic links before access-control checks.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:206

Finding

Automatic Confirmation Bypass and Password Submission

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:206-213
Vulnerability Type: Unsafe PTY automation and credential disclosure
Risk Level: High

Evidence

python

custom_responses = {
    b'Do you want to': b'y\n',
    b'Are you sure': b'y\n',
    b'Continue?': b'y\n',
    b'Press Enter to continue': b'\n',
    b'Enter password': os.environ.get('EXEC_PASSWORD', '').encode() + b'\n',
    b'Select option': b'1\n'
}

Technical Analysis

The response map uses broad text matching to approve interactive prompts automatically. Phrases such as Are you sure and Continue? are common safety gates for destructive, privileged, or irreversible operations. Automatically answering them with y removes the human authorization boundary without validating the executable, command, operation, or prompt context.

The password handler is more severe: any child process capable of printing Enter password may receive the value of EXEC_PASSWORD. There is no executable identity check, authenticated communication channel, exact prompt-state validation, or restriction to a designated credential consumer.

An attacker does not need direct access to the environment variable. A malicious command can print the matching phrase, read the PTY response, and then transmit or persist the supplied password.

Attack Path

1. An attacker introduces a malicious script, dependency, test command, or executable into a processed project.
2. The runner launches that executable through its PTY.
3. The executable prints Enter password.
4. The automation retrieves EXEC_PASSWORD from the runner environment and writes it to the PTY.
5. The malicious executable reads the submitted password and stores or exfiltrates it.
6. Alternatively, the executable prints Are you sure or Continue? before a destructive operation.
7. The runner answers y, allowing the operation to proceed without informed user approval.

Impac

...[truncated 512 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove generic automatic responses for confirmation and password prompts.
2. Require explicit user approval for destructive, privileged, deployment, or security-sensitive operations.
3. If limited automation is necessary, match an exact executable identity, exact command, exact prompt, and verified execution state.
4. Use a deny-by-default policy and define narrow operation-specific response rules.
5. Never expose a reusable password to arbitrary child processes through a PTY or inherited environment variable.
6. Use short-lived, operation-scoped credentials delivered through a dedicated secret broker or authenticated file descriptor.
7. Prevent untrusted tasks from controlling both the displayed prompt and the process receiving the response.
8. Record sensitive approval events without recording the credential or response content.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:156

Finding

Persistent Capture of Potentially Sensitive Process Output

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:156-166 and SKILL.md:300-310
Vulnerability Type: Sensitive information exposure through audit logs
Risk Level: Medium

Evidence

python

audit_config = {
    "enabled": True,
    "log_dir": ".code-runner/logs/",
    "capture_stdout": True,
    "capture_stderr": True,
    "track_changes": True,
    "retention_days": 90
}

json

{
  "audit": {
    "enabled": true,
    "log_dir": ".code-runner/logs/",
    "capture_output": true,
    "track_changes": true,
    "retention_days": 90
  }
}

Technical Analysis

The recommended configuration persistently records complete standard output and standard error for 90 days. Build systems, package managers, debugging commands, test failures, and deployment tools can print API tokens, authenticated URLs, environment-derived values, source fragments, personal data, or internal infrastructure details.

The documented log directory is inside the project tree. The artifact does not provide a concrete redaction implementation, restrictive file permissions, encryption-at-rest mechanism, access-control model, or assurance that the logs are excluded from version control and CI artifacts.

Because output capture happens after a child process generates data, preventing secrets from reaching logs requires reliable filtering before persistence. General recommendations elsewhere in the document do not demonstrate that such filtering is implemented.

Attack Path

1. A task, build tool, or malicious child process writes a secret or sensitive file content to standard output or standard error.
2. The audit subsystem captures the complete stream.
3. The sensitive value is persisted beneath .code-runner/logs/.
4. The log remains available for the configured retention period.
5. Another local user, CI artifact consumer, backup operator, repository collaborator, or compromised process access ...[truncated 574 chars]

Remediation

View remediation

Remediation Suggestions

1. Disable complete stdout and stderr capture by default.
2. Implement secret redaction before output is written to disk, including token formats, authenticated URLs, authorization headers, and configured sensitive values.
3. Store logs outside the source tree and explicitly exclude them from version control and CI artifacts.
4. Create log directories and files with restrictive ownership and permissions.
5. Encrypt audit logs at rest using managed keys and enforce role-based access.
6. Reduce retention to the minimum operationally necessary and securely delete expired records.
7. Allow tasks to mark commands and output streams as sensitive so they are omitted or summarized.
8. Test redaction against multiline values, encoded values, stderr output, stack traces, and split-stream output.
9. Document access, backup, incident-response, and credential-rotation procedures for audit-log exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description advertises enterprise code execution, batch tasks, concurrency, and CI/CD integration without a direct warning that it can execute commands and modify files. In this context, omission of a conspicuous risk warning makes accidental misuse much more likely, especially by agents operating on natural-language instructions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill claims only whitelisted commands are executed, but its interface is driven by free-form prompts for code generation and command execution. That contradiction creates a false sense of safety around effectively arbitrary execution, which is especially dangerous in a tool with exec, write, and CI/CD integration.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented automatic prompt responses approve confirmations and can inject a password from an environment variable into interactive prompts. Without a strong warning, this normalizes auto-approval of risky operations and creates a path for unintended privileged actions or credential exposure during hostile or unexpected prompt flows.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation presents execution as occurring in a 'safe sandbox' while elsewhere granting root/sudo requirements, arbitrary user execution, and PTY automation that can answer privileged prompts. This mismatch can mislead operators into trusting a highly privileged code-execution workflow, increasing the chance of unauthorized system changes, credential use, or full host compromise.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The invocation description is overly broad for a skill centered on code execution, batch automation, and file modification. Ambiguous triggering criteria can cause an agent to invoke this high-risk skill in situations where the user did not clearly intend to authorize command execution or repository changes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.