apartment-scorecard

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:18 AM UTC
• Version: 1.0.2

Overview

This skill is a local apartment comparison helper with no evidence of hidden data access, network exfiltration, or unsafe persistence.

Installers should expect this skill to run local Python scripts against apartment listing files and to store editable preferences in ~/.apartment-scorecard.json. Review any listing data you provide because it may include personal housing and budget details, but the inspected artifacts do not send that data off-machine.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill instructs the user to run local Python scripts and edit files, but the manifest declares no explicit tool scope or permission boundaries. That mismatch can lead an agent platform to grant broader shell or file-write access than intended, increasing the chance of unintended command execution or filesystem modification if the skill is invoked automatically.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

json.dump(ap.sample_listings(), f)
    with open(wf, "w") as f:
        json.dump(ap.sample_weights(), f)
    r = subprocess.run([sys.executable, os.path.join(HERE, "apartment_scorecard.py"),
                        "screen", "--file", lf, "--weights", wf],
                       capture_output=True, text=True)
    check("screen ranks survivors", "Maple St 2BR" in r.stdout

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

check("screen ranks survivors", "Maple St 2BR" in r.stdout
          and "2 pass" in r.stdout and r.returncode == 0)
    check("screen shows fails with reasons", "pets not allowed" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "apartment_scorecard.py"),
                        "compare", "--file", lf, "--weights", wf,
                        "Maple St 2BR", "Oak Rd Garden"],
                       capture_output=True, text=True)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

capture_output=True, text=True)
    check("compare renders side-by-side + premium line",
          "Premium" in r.stdout and "SCORE %" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "apartment_scorecard.py"),
                        "negotiate", "--file", lf, "--weights", wf,
                        "Maple St 2BR", "--vacant-days", "30",
                        "--lease-offer", "18"],

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with open(cf, "w") as f:
        f.write("name,rent,bedrooms,commute_min,pets_ok,available\n")
        f.write("Csv Flat,1500,1,20,true,2026-09-01\n")
    r = subprocess.run([sys.executable, os.path.join(HERE, "apartment_scorecard.py"),
                        "screen", "--file", cf, "--weights", wf],
                       capture_output=True, text=True)
    check("CSV listings load and screen", "Csv Flat" in r.stdout)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"screen", "--file", cf, "--weights", wf],
                       capture_output=True, text=True)
    check("CSV listings load and screen", "Csv Flat" in r.stdout)
    r = subprocess.run([sys.executable, os.path.join(HERE, "apartment_scorecard.py"),
                        "example"], capture_output=True, text=True)
    check("example runs end-to-end", r.returncode == 0
          and "Screened 4 listings" in r.stdout)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: When the weights file does not exist, load_json creates ~/.apartment-scorecard.json automatically. Although the criteria command later mentions the path, the write happens in code paths such as screen, compare, budget, and negotiate without a prior confirmation prompt or explicit user-facing disclosure at the moment of file creation.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_apartment_scorecard.py:16