Command Runner

• Outcome: Review
• Latest audit: Jul 10, 2026 · 12:08 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed command runner, but it gives an agent broad encoded shell-execution power with weak scoping and incomplete disclosure.

Install only if you intentionally want an agent to run arbitrary local shell commands through this wrapper. Treat it like granting terminal access: review every command before use, avoid untrusted input, and prefer a narrower skill with an allowlist for specific administrative tasks.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

command_b64 = base64.b64decode(args.command).decode("utf-8")
    command_url = urllib.parse.unquote(command_b64)

    completed = subprocess.run(
        command_url,
        shell=True,
        text=True,

• Confidence: 99% confidence
• Finding: The script decodes attacker-controlled input and passes it directly to subprocess.run with shell=True, enabling arbitrary shell command execution. The base64 and URL decoding step adds obfuscation rather than safety, making it easier to conceal dangerous payloads while still executing them on the host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill documents a general-purpose command execution path via a Python wrapper while declaring no permissions, which conceals shell-capable behavior from reviewers and policy enforcement. Because it accepts an encoded command and executes it with subprocess, this can be used to run arbitrary OS commands and potentially reach network-capable tooling already present on the host.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The manifest claims the skill is 'just test,' but the body describes a full arbitrary command-execution wrapper that decodes input and runs it through subprocess. This mismatch is dangerous because it disguises a highly privileged capability, making unsafe review, accidental deployment, or abuse more likely.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: Stating that the skill is 'just test' while documenting a command runner obscures the actual functionality and reduces the chance that operators will apply appropriate safeguards. In this context, the hidden capability is especially risky because the skill is purpose-built to execute encoded arbitrary commands and return their output.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The stated skill description says it is 'just test,' but the implementation executes arbitrary system commands and returns their output. This mismatch hides the true capability of the skill, increasing the chance that reviewers or users will underestimate the risk and approve unsafe use.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Arbitrary shell execution is not justified by the provided skill purpose and creates a direct remote-code-execution primitive. In an agent skill context, this can be abused to run destructive commands, access secrets, modify files, or pivot to other systems accessible from the host.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The comment explicitly describes decoding the input before execution, which documents an obfuscation-friendly flow that conceals the executed payload from straightforward inspection. While the comment itself is not executable, it signals and supports a design that masks dangerous behavior.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill executes shell commands immediately without any warning, confirmation, or interactive safeguard. In an agent environment, this increases the likelihood of accidental or prompt-induced execution of harmful commands with no human intervention.

Ssd 2

High

• Confidence: 98% confidence
• Finding: The documented flow decodes base64, then URL-decodes, then executes the result, which is a classic obfuscation pattern used to hide malicious commands from superficial review and logging. In combination with shell=True, this strongly suggests an intent to conceal arbitrary command execution and materially raises the risk of abuse.

Unvalidated Output Injection

High

• Category: Output Handling

Content

command_b64 = base64.b64decode(args.command).decode("utf-8")
    command_url = urllib.parse.unquote(command_b64)

    completed = subprocess.run(
        command_url,
        shell=True,
        text=True,

• Confidence: 98% confidence
• Finding: Untrusted input reaches a shell command sink without validation or escaping, allowing injection of arbitrary shell metacharacters and command chains. Because the entire decoded string is executed by the shell, an attacker can fully control process behavior on the host.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

command_b64 = base64.b64decode(args.command).decode("utf-8")
    command_url = urllib.parse.unquote(command_b64)

    completed = subprocess.run(
        command_url,
        shell=True,
        text=True,

• Confidence: 98% confidence
• Finding: The tool exposes a free-form command parameter that directly controls a powerful execution primitive. In an agent setting, this is especially dangerous because prompt injection, indirect input, or user error can turn the skill into a general-purpose arbitrary code execution capability.

Static analysis

No suspicious patterns detected.