Secure Script Runner (Zero‑Exposure Sandbox)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:55 AM UTC
• Version: 1.1.1

Overview

The skill is transparent about being a script-execution guide, but it gives opaque scripts broad local credential access without clear technical scoping.

Install only if you trust MGC Blackbox and the scripts you will run. Treat approved scripts as local code with potential access to your files, network, and MGC-stored credentials; prefer pinned dependency versions, run under a low-privilege account, deny outbound network access by default, and require separate approval for each named credential a script may use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:70

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Exposure

Content

View full analysis

=1.4.9` ``` Equivalent declarations elsewhere in the project are: ```markdown - Install: `pip install mgc-blackbox` ``` ```json "install": "pip install mgc-blackbox>=1.4.9", ``` ### Technical Analysis The Skill directs users to install `mgc-blackbox` without pinning an exact reviewed version or validating package hashes. The `>=1.4.9` constraint allows any future release, while the README imposes no version constraint at all. Package installation is necessary for the declared MGC functionality, but accepting arbitrary future versions is not necessary. Python packages and their transitive dependencies execute code with the installing user's privileges during installation or subsequent startup. Consequently, the effective behavior of this Skill can change after the Skill itself has been audited. The repository supplies no lockfile, hashes, package-index restriction, signature verification, or documented package provenance validation. There is no evidence that the named package is currently malicious; the vulnerability is the unsafe and non-reproducible dependency policy. ### Attack Path 1. An attacker compromises the upstream package, its publishing credentials, or a transitive dependency. 2. The attacker publishes a version satisfying `>=1.4.9`; alternatively, the latest release is selected by the unconstrained README command. 3. A user follows the Skill's installation instructions. 4. `pip` downloads and installs the compromised package or dependency. 5. Malicious installation or runtime code executes with the user's privileges when the package is installed or the `mgc` service is started. ### Impact Assessment Successful ex ...[truncated 453 chars]

Remediation

View remediation

``` 3. Lock all transitive dependencies and install with `pip --require-hashes`. 4. Explicitly identify the trusted package index and verified upstream project to reduce dependency-confusion and package-identity risks. 5. Run MGC under a dedicated, unprivileged operating-system account rather than as root or an administrator. 6. Review and test each dependency upgrade before changing the pinned version. 7. Make `README.md`, `SKILL.md`, and `manifest.json` use the same reviewed installation command. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:286

Finding

Opaque Scripts Can Retrieve Broadly Selected MGC Credentials

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest claims scripts will never be automatically executed, but the body recommends mgc_run to AI agents as the preferred execution path. This inconsistency weakens trust boundaries and may lead automated systems to enable or invoke the skill under the false assumption that it cannot initiate sensitive execution behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill frames itself as documentation-only and says execution requires manual approval, yet it contains direct procedural instructions for invoking execution mechanisms. That mismatch can cause an agent integrator or user to underestimate the operational risk and treat the skill as passive guidance when it is effectively an execution playbook.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

bash

# Execute script
curl -X POST http://127.0.0.1:57219/api/mgc/sensitive/run \
  -H "Content-Type: application/json" \
  -H "X-MGC-Token: $(cat ~/.mgc/database/mgc_black_box/.mgc_token)" \
  -d '{

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill expands from script execution into credential retrieval by showing how scripts can access internal MGC secrets through a local API and token. That materially increases the blast radius of any executed script, because a script that was assumed to be merely operational can also extract or misuse privileged credentials.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium

• Category: Server-Side Request Forgery
• Confidence: 89% confidence

Finding

The skill provides code that performs authenticated requests to an internal localhost service to retrieve sensitive data. Although this is not classic arbitrary SSRF, it is an internal privileged network access pattern that can be abused by executed scripts to reach local control-plane APIs and extract secrets or perform sensitive actions.

Content

Scanner excerpt · SKILL.md (reported line 303)May include surrounding context.

md

"info_owner": info_owner
    }).encode("utf-8")

    req = urllib.request.Request(
        "http://127.0.0.1:57219/api/mgc/sensitive/get",
        data=data,
        headers={

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · manifest.json (reported line 5)May include surrounding context.

json

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · manifest.json (reported line 29)May include surrounding context.

json

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 5)May include surrounding context.

md

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · manifest.json (reported line 5)May include surrounding context.

json

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · manifest.json (reported line 29)May include surrounding context.

json

"id": "secure_script_runner",
  "version": "1.1.1",
  "name": "Secure Script Runner (Zero‑Exposure Sandbox)",
  "description": "Zero‑exposure script execution using MGC Blackbox. Store scripts encrypted, execute in blackbox, AI sees no plaintext. Supports MCP (mgc_run) / API / WebUI execution, internal credential calls, and script sealing. Includes MGC 1.4.9 temporary workaround guidelines. This skill only executes scripts with explicit user authorization and will never automatically execute any scripts.",
  "author": "MirginCipher Team",
  "license": "MIT",
  "tags": ["security", "script", "zero-exposure", "mgc", "sandbox", "execution", "blackbox"],

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The overview frames the workflow as zero plaintext exposure to the AI, but the documentation itself embeds plaintext script bodies in examples such as content="print('Hello from zero‑exposure!')". While instructional examples are understandable, the wording is absolute and therefore contradicts the actual content shown to the AI reader.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.