Python Code Tester

• Outcome: Review
• Latest audit: May 28, 2026 · 9:51 AM UTC
• Version: 1.0.3

Overview

This is a coherent Python testing skill, but it can install packages, run generated tests, and direct changes to real project files without clear approval gates.

Install only in a disposable or version-controlled workspace. Review generated tests before running them, avoid running package installation on your main Python environment, and require a manual diff review before applying any suggested source-code changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

}
    
    try:
        proc = subprocess.run(
            ["python", "-m", "pytest", str(test_file), "-v", "--tb=short"],
            capture_output=True,
            text=True,

• Confidence: 96% confidence
• Finding: The script generates a pytest file from user-controlled requirement/keyword inputs and then executes it with `python -m pytest`. Because the generated test code interpolates identifiers such as module/class/function names derived from repository contents without sanitization, an attacker who can influence the scanned codebase or inputs may cause arbitrary Python code to be written and executed. In this skill context, executing tests is expected, but doing so on auto-generated code substantially increases risk.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

req_file = SCRIPTS_DIR / "requirements.txt"
    if req_file.exists():
        try:
            subprocess.run(["pip", "install", "-r", str(req_file)], check=True)
            return True
        except subprocess.CalledProcessError:
            return False

• Confidence: 98% confidence
• Finding: The skill automatically runs `pip install -r requirements.txt` with no confirmation, allowing package installation and arbitrary code execution via package setup hooks or malicious dependencies. Since `requirements.txt` is taken from the skill/script directory and not verified or pinned, this modifies the environment and expands the trust boundary far beyond simple testing.

Tainted flow: 'test_file' from pathlib.Path.read_text (line 554, file read) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

}
    
    try:
        proc = subprocess.run(
            ["python", "-m", "pytest", str(test_file), "-v", "--tb=short"],
            capture_output=True,
            text=True,

• Confidence: 94% confidence
• Finding: This is effectively a tainted-code-execution path: the script writes a test file influenced by scanned repository content and user input, then immediately executes it via pytest. Even though the subprocess call is not shell-invoked, pytest will import and run attacker-controlled Python code from the generated file and potentially project modules under test.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill directs the agent to read project code, write files under multiple directories, access the network to download datasets, and run tests, yet it declares no permissions or user-facing capability boundaries. This creates a dangerous mismatch: a caller may invoke the skill without understanding it can modify repository contents, execute shell-like actions, or exfiltrate data through network access.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill includes an automatic package installation capability that is broader and more dangerous than a typical code-testing function requires. In practice this permits environment mutation and potential arbitrary code execution from dependency installation, making the skill materially more dangerous in this context.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill is activated by broadly phrased user testing requests without clear scope limits, exclusions, or approval gates. Because the workflow includes code search, artifact creation, execution, and code modification, overly broad triggering increases the chance the skill performs risky actions in unintended contexts.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the agent to save generated artifacts, create release directories, and update actual project files, but provides no explicit warning or consent checkpoint before modifying repository data. In a testing context this is especially risky because a benign request can escalate into persistent changes to source code and test assets, potentially corrupting the repo or introducing unauthorized changes.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs downloading external datasets from the network without a user-facing warning, approval step, or restrictions on allowed sources. This can expose sensitive metadata, introduce untrusted content into the environment, and create supply-chain or privacy risks during routine testing flows.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: Automatically installing dependencies without explicit user confirmation is unsafe because it silently changes the execution environment and may run untrusted package code. This is especially risky for an agent skill, where users may not expect package management side effects from a testing action.

Missing User Warnings

High

• Confidence: 88% confidence
• Finding: The function can overwrite project source files and create backup files without explicit confirmation. Although it is not invoked in the current main flow, the capability exists and could cause destructive or unintended code changes if wired in later or called by other code, especially because the replacement boundaries come from loosely parsed code metadata.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 代码功能测试 Skill 依赖

# 测试框架
pytest>=7.0.0

# 数据处理
numpy>=1.21.0

• Confidence: 92% confidence
• Finding: Using an unpinned dependency like pytest>=7.0.0 allows future installs to resolve to newer versions, which can unexpectedly introduce vulnerable, incompatible, or malicious package releases. In a testing skill that executes code and tests automatically, dependency drift increases supply-chain risk and can affect both integrity and reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pytest>=7.0.0

# 数据处理
numpy>=1.21.0
pandas>=1.3.0

• Confidence: 95% confidence
• Finding: Using numpy>=1.21.0 permits installation of a broad set of versions, including ones that may contain known flaws or future regressions. Because this skill searches code, generates tests, and executes them, any compromised or vulnerable numerical library in the environment can meaningfully expand supply-chain and runtime attack surface.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# 数据处理
numpy>=1.21.0
pandas>=1.3.0

• Confidence: 93% confidence
• Finding: Using pandas>=1.3.0 leaves dependency resolution open-ended, so builds may silently pull in different versions over time, including vulnerable or breaking releases. In an automated code-testing context, this increases supply-chain risk and can undermine deterministic execution.

Known Vulnerable Dependency: pytest — 1 advisory(ies): CVE-2025-71176 (pytest has vulnerable tmpdir handling)

Low

• Category: Supply Chain
• Confidence: 67% confidence
• Finding: The file references pytest without an upper bound or exact pin, and the static analysis reports a known advisory affecting some pytest versions. While exploitability depends on the resolved version and whether the vulnerable tmpdir behavior is exercised, the dependency declaration can allow installation of an affected release.

Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more

Critical

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: The numpy requirement is broad enough to include versions associated with multiple published advisories, some involving memory-safety or file-write issues. Because this skill performs code-related automation and test execution, using a vulnerable numerical library could increase the impact of malicious inputs or unsafe runtime behavior in the host environment.

Static analysis

No suspicious patterns detected.