Mac System Stat

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 2:20 AM UTC
• Version: 1.0.1

Overview

This skill is a coherent local macOS system-statistics helper with disclosed self-build behavior and no evidence of network access, exfiltration, hidden persistence, or destructive actions.

Install only if you want a local macOS hardware/resource snapshot tool and are comfortable with it compiling local Swift helpers on first use. Review the generated host output before sharing it, because it can include hostname, process names, hardware identifiers, temperatures, fan speeds, and power readings.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using subprocess.run with shell=True creates a high-risk tool abuse surface because any upstream caller can supply a single string that the shell interprets as multiple operations. In an agent skill context, reusable helpers like this are especially dangerous because they lower the barrier for later components to execute arbitrary system commands, increasing the chance of prompt-driven or input-driven command injection.

Content

Scanner excerpt · scripts/_common.py (reported line 25)May include surrounding context.

python

def run_shell(cmd: str, timeout: int = 20) -> str:
    try:
        p = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout, executable=ZSH)
    except Exception as e:
        return f"ERROR: {e}"
    return (p.stdout or p.stderr or "").strip()

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

## Notes
- macOS only; Apple Silicon first
- Default path avoids sudo
- Prefer helper JSON over hand-written summaries
- GPU reads IORegistry properties directly via IOKit instead of parsing `ioreg` text
- Power uses IOReport Energy Model deltas; values are short-window averages, not hardware-meter absolutes

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_common.py (reported line 17)May include surrounding context.

python

def run(cmd: List[str], timeout: int = 15) -> str:
    try:
        p = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
    except Exception as e:
        return f"ERROR: {e}"
    return (p.stdout or p.stderr or "").strip()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The run_shell helper executes arbitrary shell commands via subprocess.run(..., shell=True, executable=ZSH) but provides no confirmation prompt, comment, docstring, or user-facing log indicating that shell execution will occur. Because subprocess execution is a safety-relevant operation in code files, the absence of any disclosure makes the behavior insufficiently signposted.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

This helper executes arbitrary shell text with shell=True, which allows shell metacharacters, command chaining, expansion, and redirection to be interpreted by zsh. If any part of cmd is influenced by untrusted input, this becomes a command-injection sink that can lead to arbitrary code execution under the agent's privileges.

Content

Scanner excerpt · scripts/_common.py (reported line 25)May include surrounding context.

python

def run_shell(cmd: str, timeout: int = 20) -> str:
    try:
        p = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout, executable=ZSH)
    except Exception as e:
        return f"ERROR: {e}"
    return (p.stdout or p.stderr or "").strip()

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

This code invokes /bin/zsh to run a build script from a caller-controlled root path, then trusts the resulting binary and executes it later. If an attacker can influence the repository contents or root directory, they can replace build-swift-helpers.sh or the Swift sources and achieve arbitrary code execution during the build step; using a shell to launch the script increases exposure to executing unintended local content.

Content

Scanner excerpt · scripts/_swift_helper.py (reported line 30)May include surrounding context.

python

needs_build = not binary.exists() or any(binary.stat().st_mtime < path.stat().st_mtime for path in source_paths)
    if needs_build:
        build = subprocess.run(
            ["/bin/zsh", str(build_script), helper_name],
            check=False,
            cwd=root,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/_swift_helper.py (reported line 45)May include surrounding context.

python

def run_helper(root: Path, helper_name: str, args: Optional[Iterable[str]] = None, timeout: float = 30) -> Dict[str, Any]:
    binary = ensure_binary(root, helper_name)
    proc = subprocess.run(
        [str(binary), *(list(args or []))],
        capture_output=True,
        text=True,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/hoststat.py (reported line 18)May include surrounding context.

python

def run_helper(path: Path) -> Tuple[str, Dict[str, Any]]:
    proc = subprocess.run([sys.executable, str(path)], capture_output=True, text=True, timeout=40)
    if proc.returncode != 0:
        return path.name, {"ok": False, "error": (proc.stderr or proc.stdout).strip()}
    try:

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/swift/fanstat_helper.swift (reported line 79)May include surrounding context.

text

var status: UInt8 = 0
    var data8: UInt8 = 0
    var data32: UInt32 = 0
    var bytes: Bytes = (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
}

struct SMCValue {

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/swift/tempstat_helper.swift (reported line 82)May include surrounding context.

text

var status: UInt8 = 0
    var data8: UInt8 = 0
    var data32: UInt32 = 0
    var bytes: Bytes = (0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0)
}

struct SMCValue {

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/tempstat.py (reported line 25)May include surrounding context.

python

def read_thermal_status() -> Dict[str, Any]:
    try:
        proc = subprocess.run([PMSET, "-g", "therm"], capture_output=True, text=True, timeout=10)
    except Exception as e:
        return {"available": False, "notes": [f"pmset therm failed: {e}"]}

Static analysis

No suspicious patterns detected.