Agentscope Skill

• Outcome: Review
• Latest audit: May 28, 2026 · 12:59 PM UTC
• Version: 1.0.0

Overview

This appears to be a real AgentScope guide, but it encourages broad code execution, shell access, file access, browser automation, and remote repository updates without enough guardrails.

Install only if you want an AgentScope development/reference skill and are comfortable with examples that can run local code, shell commands, browser actions, and server-side file reads. Do not let an agent follow the clone/pull or execution examples automatically in sensitive workspaces; use explicit approval, a sandbox, limited API keys, pinned repository versions, and avoid exposing the provided shell/Python/file tools to untrusted users.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (214)

eval() call detected

High

• Category: Dangerous Code Execution

Content

"""
    try:
        # Simple calculation (in real scenario, use safer evaluation)
        result = eval(expression)  # noqa: S307
        return ToolResponse(
            content=[
                TextBlock(

• Confidence: 99% confidence
• Finding: The calculate tool evaluates attacker-controlled input with Python eval(), which can execute arbitrary code rather than only arithmetic. In an agent/tooling context, the expression may be influenced by user prompts or model-generated tool arguments, turning this example into a code-execution primitive.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill instructs the agent to clone or update a remote GitHub repository locally before doing anything else, causing both network access and filesystem writes. For a guidance skill, this is unnecessarily invasive and can be abused to trigger unprompted external fetches, workspace modification, supply-chain exposure, and persistence of unreviewed code.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The example normalizes registration of execute_shell_command and execute_python_code as general-purpose tools in a chatbot. That materially expands the agent's action surface beyond answering AgentScope questions, making command execution and arbitrary code execution appear like standard recommended practice.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The README demonstrates registering tools that can execute arbitrary Python code and shell commands, which materially expands an agent from informational guidance into system-action capability. In the context of a reusable skill, this is dangerous because downstream users may copy the example into an agent without sandboxing or authorization controls, enabling command execution on the host.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The tutorial explicitly registers `execute_python_code` as a tool, giving the agent arbitrary code execution capability. In an agent quickstart context, this is dangerous because the example immediately encourages model-directed execution of Python from natural-language input, which can normalize unsafe patterns and lead to command/code execution if reused in real deployments without sandboxing.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The example explicitly equips a worker agent with an unrestricted Python execution tool and then lets an LLM decide how to use it. In documentation context this is dangerous because readers may copy the pattern into real systems, enabling arbitrary code execution from model-generated instructions without sandboxing, approval, or scope limits.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: The tutorial invokes asyncio.run(example_router_explicit()) at module scope, causing a live external model call when the file is executed. In a documentation-oriented skill, auto-executing networked examples broadens capability unexpectedly and can trigger unintentional API usage, cost, and data disclosure from user prompts.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The second example also auto-executes a routed workflow with tools and an external model service via asyncio.run(example_router_implicit()) at module scope. Because routing can invoke downstream tool functions, this increases the risk of unintended network actions and side effects when a user expects passive documentation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The tutorial registers `execute_python_code` as an agent-available tool, giving the LLM the ability to run arbitrary Python based on user requests. In an agent quickstart example, this materially increases risk because prompt injection, misuse, or copied production usage could lead to local code execution, file access, subprocess execution, or data exfiltration far beyond simple AgentScope guidance.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The documentation example gives dynamically spawned worker agents a general Python execution tool, which materially expands capability beyond simple framework guidance. In a handoff pattern, the parent agent can pass arbitrary task text to the worker, so unsafe prompts or copied examples could lead to arbitrary local code execution if users run this sample as-is.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The agent card advertises Python code execution and shell command execution capabilities, plus server file viewing, which are materially more powerful than the stated purpose of helping with AgentScope documentation and guidance. Exposing these capabilities increases the chance that downstream clients, orchestrators, or users will invoke dangerous server-side actions that can lead to remote code execution, system compromise, or unintended access to local resources.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Advertising a file-viewing skill for server-side text files is inconsistent with a documentation/help skill and can expose sensitive local data such as configuration files, prompts, logs, or secrets if consumed by an external A2A client. Even read-only access can materially aid attackers by revealing environment details and credentials.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This example server registers powerful tools that allow arbitrary Python execution, shell command execution, and file reading, then exposes them to a ReAct agent that processes incoming A2A messages. In a server context, this creates a direct prompt-to-capability path where remote user input or model manipulation can trigger code execution on the host, which is far more dangerous than the skill's documentation-oriented purpose would suggest.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The agent card advertises server-side Python execution, shell command execution, and server file viewing even though the stated skill purpose is general AgentScope guidance. This creates a dangerous mismatch between declared purpose and exposed capabilities, increasing the chance that users or downstream orchestrators invoke powerful actions that enable remote code execution, command execution, or unauthorized file disclosure on the host.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Advertising a shell-command skill on the server is unjustified for a documentation/help agent and exposes one of the highest-risk primitives available to an attacker. If reachable through prompts, tool routing, or misconfiguration, it can be abused to run arbitrary OS commands, access secrets, modify files, or pivot further into the environment.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Server-side Python execution is an unnecessary and dangerous capability for an agent whose stated role is answering AgentScope questions and providing guidance. Arbitrary Python execution can lead to full compromise of application data and the underlying runtime through file access, subprocess spawning, network calls, and secret extraction.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Allowing arbitrary text-file viewing on the server is not justified by the documented help-and-guidance purpose and can expose configuration, source code, credentials, tokens, and internal data. Even read-only file access can materially aid reconnaissance and enable follow-on attacks.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The prompt explicitly instructs the downstream agent to use `execute_shell_command` to load schema/examples from a skill directory, even though this component's role is only to build a UI prompt string. Embedding tool-use instructions for shell execution in a prompt increases the attack surface for prompt injection and unintended command execution, especially if the referenced skill content or working directory can be influenced.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This example server registers execute_python_code and execute_shell_command as agent tools, giving the model a direct path to arbitrary code execution on the host. In the context of a network-exposed A2A/UI agent for general queries, this is materially dangerous because prompt injection, jailbreaks, or unsafe tool selection can turn ordinary user input into host command execution.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The skill instructs the agent to use a broad shell-execution capability merely to read local schema/template data. That grants far more power than needed for the stated task and creates a path for command injection, misuse of the current working directory, or accidental execution of unintended commands if this guidance is followed by an autonomous agent.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: This example implements an active browser automation agent with state-changing capabilities, which exceeds the declared skill purpose of AgentScope library guidance and documentation assistance. In this context, the mismatch matters because a user invoking a documentation-oriented skill may unknowingly trigger real browser actions against external sites, expanding the attack surface and enabling unintended side effects.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: Registering file download and form-filling tools gives this skill capabilities that are unnecessary for answering questions about the AgentScope Python library. Unnecessary privileged actions increase the chance of misuse, prompt injection-driven behavior, and accidental interaction with external systems or sensitive data.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The code automatically enumerates tabs, closes extra tabs, and navigates to a configured external URL. For a skill advertised as library guidance, these are unjustified side-effecting browser operations that can disrupt a user's browser session and interact with untrusted websites without a task-specific need.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This prompt clearly turns the skill into a general-purpose autonomous browser agent rather than a constrained AgentScope-help skill. That scope expansion is dangerous because it enables navigation and task execution on arbitrary websites, increasing the chance of data access, unintended transactions, or abuse beyond the stated purpose of providing AgentScope guidance.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The prompt authorizes form filling, file downloading, image understanding, and video analysis even though the skill is described as help for the AgentScope Python library. These unrelated capabilities materially widen the attack surface and could be used to submit data, retrieve untrusted files, or process sensitive local content without a clear user-justified need.

Static analysis

Detected: suspicious.autonomous_credential_egress, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal (+1 more)

Autonomous schedule or loop submits credential-bearing agent output without per-call consent.

Critical

• Code: suspicious.autonomous_credential_egress
• Location: agentscope/examples/agent/a2ui_agent/samples/general_agent/skills/A2UI_response_generator/UI_templete_examples/selection_card.py:24

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: agentscope/examples/functionality/long_term_memory/reme/tool_memory_example.py:72

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: agentscope/src/agentscope/memory/_long_term_memory/_reme/_reme_long_term_memory_base.py:227

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: agentscope/tests/memory_reme_test.py:54

WebSocket connection to non-standard port detected.

Warn

• Code: suspicious.nonstandard_network
• Location: agentscope/docs/tutorial/en/src/task_realtime.py:369

WebSocket connection to non-standard port detected.

Warn

• Code: suspicious.nonstandard_network
• Location: agentscope/docs/tutorial/zh_CN/src/task_realtime.py:364