T09 · Insecure Skill Coding Practices
Error
- Location
run_pipeline.js:58- Finding
Arbitrary Shell Command Execution Through Untrusted Pipeline Arguments
- Content
View full analysis
- Remediation
View remediation
Security audit
Hle Benchmark Evolver
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its benchmark-evolution purpose, but its pipeline can run arbitrary shell commands and broader evolution actions without enough scoping or safeguards.
Install only if you trust the users or automation that will supply pipeline arguments. Treat --eval_cmd as full local shell access, avoid passing untrusted report paths or evaluator templates, keep solidify dry-run enabled unless you intend to mutate evolution artifacts, and prefer a sandboxed or allowlisted evaluator wrapper.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `run_pipeline.js` links ingestion, evolve, and solidify into one executable loop.
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The pipeline accepts a fully user-controlled --eval_cmd string, substitutes {{report}}, and executes it via bash without validation, allowlisting, or sandboxing. This creates direct arbitrary command execution in the agent/workspace context, which is far broader than the skill's stated purpose of benchmark ingestion and curriculum generation.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill advertises shell commands and code-execution workflows but declares no explicit tool scope or permissions boundary. That creates ambiguity about what runtime capabilities the agent may use, increasing the chance of unintended environment access or execution in a broader context than intended, especially because it accepts external file paths and shell-based evaluator commands.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The 'Safe execution' comment is misleading because the branch writes attacker-controlled command text to a temporary script and executes it with bash. Mislabeling dangerous behavior as safe increases the chance reviewers or maintainers will overlook the arbitrary code execution risk and retain insecure patterns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code executes arbitrary shell commands from --eval_cmd immediately, with no confirmation, warning, or policy check despite operating in an agent skill context. In systems where users may not realize a benchmark option grants shell access, this materially increases the chance of accidental or malicious destructive execution.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
Beyond ingesting benchmark results and generating curriculum data, the script invokes capability-evolver's run and solidify commands, which can perform broader agent evolution actions. That is a stronger orchestration capability than the manifest's benchmark-focused description implies, especially since solidify may commit changes when dry-run is disabled.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script emits a natural-language status message only in Chinese when quota exhaustion is detected. This forces a specific language for a user-facing message without offering localization, opt-in, or any documented region-specific justification.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script accepts a user-controlled --out path, resolves it to an absolute path, and writes to it with fs.writeFileSync without any restriction, confirmation, or sandboxing. In an agent/skill context, this can overwrite arbitrary files writable by the current user, which is dangerous even though the content written is only a JSON summary.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- index.js:10
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- run_pipeline.js:43