job-offer-comparator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 1.0.0

Overview

This skill is a local, purpose-aligned job offer comparison calculator with no evidence of hidden network access, persistence, credential handling, or destructive behavior.

Before installing, expect to run a local Python script against job-offer details you provide. Keep sensitive offer documents local, review the gross-of-tax limitation, and avoid treating the output as financial, tax, or legal advice.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill instructs the agent to run local Python scripts and read/write local files (scripts/offer_compare.py, offers.json), which implies shell and file access, but it does not declare any permissions or allowed-tools scope. That mismatch weakens least-privilege controls and can cause the platform or user to grant broader access than necessary, increasing the blast radius if the skill or referenced scripts are modified or abused.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_offer_compare.py (reported line 163)May include surrounding context.

python

with tempfile.NamedTemporaryFile("w", suffix=".json", delete=False) as f:
        json.dump(offers, f)
        path = f.name
    r = subprocess.run([sys.executable, SCRIPT, "compare", "--file", path,
                        "--json"], capture_output=True, text=True)
    ok("compare --json exits 0", r.returncode == 0, r.stderr[:200])
    try:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_offer_compare.py (reported line 183)May include surrounding context.

python

# -------------------------------------------------------- 9. CLI validation
def test_cli_validation():
    # single offer rejected
    r = subprocess.run(
        [sys.executable, SCRIPT, "compare", "--offer", json.dumps(variant())],
        capture_output=True, text=True)
    ok("single offer rejected (exit 2)", r.returncode == 2,

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_offer_compare.py (reported line 189)May include surrounding context.

python

ok("single offer rejected (exit 2)", r.returncode == 2,
       f"rc={r.returncode} err={r.stderr[:120]}")
    # bad JSON rejected
    r = subprocess.run(
        [sys.executable, SCRIPT, "compare", "--offer", "{not json",
         "--offer", json.dumps(variant())],
        capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_offer_compare.py (reported line 198)May include surrounding context.

python

# missing required field
    bad = variant()
    del bad["base"]
    r = subprocess.run(
        [sys.executable, SCRIPT, "compare", "--offer", json.dumps(bad),
         "--offer", json.dumps(variant())],
        capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_offer_compare.py (reported line 204)May include surrounding context.

python

capture_output=True, text=True)
    ok("missing 'base' rejected (exit 2)", r.returncode == 2, f"rc={r.returncode}")
    # duplicate names rejected
    r = subprocess.run(
        [sys.executable, SCRIPT, "compare", "--offer", json.dumps(variant()),
         "--offer", json.dumps(variant())],
        capture_output=True, text=True)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/test_offer_compare.py (reported line 215)May include surrounding context.

python

with tempfile.NamedTemporaryFile("w", suffix=".json", delete=False) as f:
        json.dump(three, f)
        path = f.name
    r = subprocess.run([sys.executable, SCRIPT, "breakeven", "--file", path],
                       capture_output=True, text=True)
    ok("breakeven with 3 offers rejected (exit 2)", r.returncode == 2,
       f"rc={r.returncode}")