Code Factory

• Outcome: Review
• Latest audit: Jul 9, 2026 · 9:31 PM UTC
• Version: 1.0.1

Overview

This skill is a coherent project generator, but it gives broad automation enough host access to install dependencies, run generated tests, mutate files, and retain failure details without tight scoping.

Install only if you are comfortable with a local automation skill that writes project files, installs packages, and executes generated tests. Use it in a disposable workspace or container, avoid running it where sensitive environment variables are present, review generated files before execution, and clean up .learnings data if prompts, paths, or test output may be sensitive.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

existing_path = env.get("PYTHONPATH", "")
            env["PYTHONPATH"] = f"{target_dir}{os.pathsep}{existing_path}" if existing_path else str(target_dir)

            result = subprocess.run(
                [sys.executable, "-m", "pytest", str(test_dir), "-v", "--tb=short"],
                capture_output=True,
                text=True,

• Confidence: 94% confidence
• Finding: This code executes pytest in a subprocess against a target directory that appears to contain generated or otherwise untrusted project content. Running tests is equivalent to executing arbitrary Python code, and the only isolation used is a temporary working directory plus inherited environment variables, which does not sandbox filesystem, network, or process access.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill's short description materially understates its behavior: beyond generating project files, it performs environment inspection, executes package installation and tests, mutates files iteratively, and persists learning artifacts. This mismatch can cause an agent or operator to invoke a much more privileged workflow than expected, increasing the risk of unsafe command execution, unintended file modification, and persistence on the host.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: This is a real integrity/availability issue: the code claims atomic behavior, but it unlinks delete targets before all create/modify operations have completed, and on copy failure it removes newly copied files rather than restoring prior versions of modified files. As a result, a partial commit can leave the project in an inconsistent state with deleted files restored only in some cases and previously existing modified files permanently missing.

Vague Triggers

High

• Confidence: 92% confidence
• Finding: The trigger phrases are broad enough to match ordinary requests such as 'write me a tool' or 'create a project,' causing the skill to auto-activate in many contexts. Because this skill has `exec` and file-write capabilities, over-broad activation raises the chance of unintended code generation, dependency installation, shell execution, and filesystem changes without sufficiently explicit user intent.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The controller writes detailed failure diagnostics, including project_name, retry history, current step, and verification_report, into a persistent .learnings directory on disk. In an agent skill that may process sensitive prompts, code, or test output, this creates an unintended local data-retention channel that can expose confidential information to other processes, users, or later runs if the workspace is shared or collected.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The generated SKILL.md grants powerful capabilities including write, edit, and exec by default, and the usage text explicitly tells the operator to run the produced code directly. In an agent-skill context, this increases the chance that downstream users or systems will execute unreviewed generated code with filesystem and command-execution privileges, which can enable harmful actions if the generated project is compromised or behaves unexpectedly.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

isolated_cwd = tempfile.mkdtemp(prefix="code_factory_pytest_")

        try:
            env = os.environ.copy()
            existing_path = env.get("PYTHONPATH", "")
            env["PYTHONPATH"] = f"{target_dir}{os.pathsep}{existing_path}" if existing_path else str(target_dir)

• Confidence: 87% confidence
• Finding: The verifier copies the full parent process environment into the pytest subprocess while executing untrusted test code. That can expose secrets such as API keys, tokens, cloud credentials, proxy settings, and internal configuration to attacker-controlled tests, which may read and exfiltrate them.

Unbounded Resource Access

Medium

• Category: Excessive Agency

Content

return self.breaker.execute_with_timeout(
                verify_fn,
                timeout_seconds=timeout_seconds,
                on_timeout=None,
            )
        except Exception:
            return None

• Confidence: 90% confidence
• Finding: The public verify_with_timeout API accepts timeout_seconds=None and forwards it directly to the timeout wrapper, which can result in an effectively unbounded verification call if the breaker implementation treats None as no timeout. In an automation pipeline that promises tests/verification before delivery, a hanging verifier can stall worker threads or jobs indefinitely, causing denial of service and reducing the effectiveness of pipeline protections.

Known Vulnerable Dependency: pytest — 2 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: The development dependency allows pytest versions >=7.0 with no upper bound, and the supplied finding indicates affected versions include a tmpdir-handling vulnerability. Because this skill explicitly emphasizes running tests before delivery, the test toolchain is part of the operational path; using a vulnerable pytest version could expose the environment during test execution, especially in untrusted or generated project contexts.

Static analysis

No suspicious patterns detected.