📦
Audit-Verlauf
python-executor - 4 Audits
Versionsvergleich
Änderungen an Fähigkeiten und Befunden über geprüfte Versionen hinweg, neueste zuerst.
| Version | Datum | Ergebnis | Prüfelemente | Änderung ggü. vorheriger |
|---|---|---|---|---|
| v4 Neueste | 5 июл. 2026 г., 17:54 | 2 bestätigt | 16 | Keine Änderung der Fähigkeiten |
| v3 | 5 июл. 2026 г., 17:54 | 2 bestätigt | 16 | Keine Änderung der Fähigkeiten |
| v2 | 30 июн. 2026 г., 04:20 | 2 bestätigt | 0 | Keine Änderung der Fähigkeiten |
| v1 | 15 мая 2026 г., 09:15 | Keine bestätigten Befunde | 1 | Ausgangsbasis |
Audit-Version 4 Neueste
5 июл. 2026 г., 17:54
Most static shell findings are Markdown backticks or examples, but the skill intentionally routes code through the external belt CLI and inference.sh. Confirmed risks include remote arbitrary Python execution, outbound network examples, mutable install dependencies, and automatic returned output files; no prompt injection text was found.
1
Gescannte Dateien
188
Analysierte Zeilen
20
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Hoch
Arbitrary Python Execution Through External Service
The skill permits belt commands and shows users how to submit arbitrary Python code to infsh/python-executor. Even with sandboxing, this sends code and inputs to a third-party execution service.
The allowed-tools declaration and quick start show the execution path, and the use-case list says automation can run any Python script.
Mittel
Automatic Output Return Can Expose Data
The skill states that files saved under outputs are automatically returned. If user code writes private data there, the response can expose those files outside the intended workflow.
The file output section explicitly describes automatic return of saved artifacts and lists examples of generated files.
Elemente der Fähigkeitsprüfung (16)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Mittel
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line instructs users to run npx to install an external CLI skill. It is not auto-executed, but it introduces a supply-chain and external command risk.
Mittel
SKILL.md:19-26SKILL.md:82-86SKILL.md:90-94SKILL.md:98-102SKILL.md:106-111SKILL.md:115-119SKILL.md:123-127SKILL.md:143-149SKILL.md:171-180
Ruby/shell backtick execution · 9 Vorkommen
```bash
This bash example invokes belt app run to send Python code to infsh/python-executor. The command is intentional, but it is real external execution of user-provided code through a remote CLI.
Niedrig
Python HTTP libraries
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The web scraping example runs Python requests against https://example.com through the executor. This confirms outbound network capability in submitted code.
Niedrig
Python HTTP libraries
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The API example runs Python requests against the GitHub API through the executor. This confirms outbound network capability in submitted code.
Niedrig
Hardcoded URL
description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen
The description states that execution happens via inference.sh, which is an external service boundary. User code and inputs may be sent to that service when the skill is used.
Niedrig
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The install guidance links to a raw GitHub-hosted instruction file. It is user-driven rather than automatic, but mutable external setup instructions create a low supply-chain risk.
Niedrig
Hardcoded URL
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The web scraping example runs Python requests against https://example.com through the executor. This confirms outbound network capability in submitted code.
Niedrig
Hardcoded URL
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The API example runs Python requests against the GitHub API through the executor. This confirms outbound network capability in submitted code.
Risikofaktoren
⚙️ Externe Befehle (41)
SKILL.md:7 SKILL.md:17 SKILL.md:19-26 SKILL.md:26-33 SKILL.md:33-40 SKILL.md:40-47 SKILL.md:47-52 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55-58 SKILL.md:58 SKILL.md:59 SKILL.md:62 SKILL.md:63 SKILL.md:66-67 SKILL.md:67 SKILL.md:68-71 SKILL.md:71 SKILL.md:72 SKILL.md:75 SKILL.md:76 SKILL.md:82-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-127 SKILL.md:127-131 SKILL.md:131-133 SKILL.md:133-139 SKILL.md:139-143 SKILL.md:143-149 SKILL.md:149-166 SKILL.md:166 SKILL.md:171-180
🌐 Netzwerkzugriff (10)
Geprüft von: codex
5 июл. 2026 г., 17:54
Most static shell findings are Markdown backticks or examples, but the skill intentionally routes code through the external belt CLI and inference.sh. Confirmed risks include remote arbitrary Python execution, outbound network examples, mutable install dependencies, and automatic returned output files; no prompt injection text was found.
1
Gescannte Dateien
188
Analysierte Zeilen
20
Prüfelemente
0
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Hoch
Arbitrary Python Execution Through External Service
The skill permits belt commands and shows users how to submit arbitrary Python code to infsh/python-executor. Even with sandboxing, this sends code and inputs to a third-party execution service.
The allowed-tools declaration and quick start show the execution path, and the use-case list says automation can run any Python script.
Mittel
Automatic Output Return Can Expose Data
The skill states that files saved under outputs are automatically returned. If user code writes private data there, the response can expose those files outside the intended workflow.
The file output section explicitly describes automatic return of saved artifacts and lists examples of generated files.
Elemente der Fähigkeitsprüfung (16)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Mittel
Ruby/shell backtick execution
> **Install the belt CLI skill:** `npx skills add belt-sh/cli`
This line instructs users to run npx to install an external CLI skill. It is not auto-executed, but it introduces a supply-chain and external command risk.
Mittel
SKILL.md:19-26SKILL.md:82-86SKILL.md:90-94SKILL.md:98-102SKILL.md:106-111SKILL.md:115-119SKILL.md:123-127SKILL.md:143-149SKILL.md:171-180
Ruby/shell backtick execution · 9 Vorkommen
```bash
This bash example invokes belt app run to send Python code to infsh/python-executor. The command is intentional, but it is real external execution of user-provided code through a remote CLI.
Niedrig
Python HTTP libraries
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The web scraping example runs Python requests against https://example.com through the executor. This confirms outbound network capability in submitted code.
Niedrig
Python HTTP libraries
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The API example runs Python requests against the GitHub API through the executor. This confirms outbound network capability in submitted code.
Niedrig
Hardcoded URL
description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen
The description states that execution happens via inference.sh, which is an external service boundary. User code and inputs may be sent to that service when the skill is used.
Niedrig
Hardcoded URL
> Requires inference.sh CLI (`belt`). [Install instructions](https://raw.githubusercontent.com/infer
The install guidance links to a raw GitHub-hosted instruction file. It is user-driven rather than automatic, but mutable external setup instructions create a low supply-chain risk.
Niedrig
Hardcoded URL
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The web scraping example runs Python requests against https://example.com through the executor. This confirms outbound network capability in submitted code.
Niedrig
Hardcoded URL
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The API example runs Python requests against the GitHub API through the executor. This confirms outbound network capability in submitted code.
Risikofaktoren
⚙️ Externe Befehle (41)
SKILL.md:7 SKILL.md:17 SKILL.md:19-26 SKILL.md:26-33 SKILL.md:33-40 SKILL.md:40-47 SKILL.md:47-52 SKILL.md:52 SKILL.md:53 SKILL.md:54 SKILL.md:55-58 SKILL.md:58 SKILL.md:59 SKILL.md:62 SKILL.md:63 SKILL.md:66-67 SKILL.md:67 SKILL.md:68-71 SKILL.md:71 SKILL.md:72 SKILL.md:75 SKILL.md:76 SKILL.md:82-86 SKILL.md:86-90 SKILL.md:90-94 SKILL.md:94-98 SKILL.md:98-102 SKILL.md:102-106 SKILL.md:106-111 SKILL.md:111-115 SKILL.md:115-119 SKILL.md:119-123 SKILL.md:123-127 SKILL.md:127-131 SKILL.md:131-133 SKILL.md:133-139 SKILL.md:139-143 SKILL.md:143-149 SKILL.md:149-166 SKILL.md:166 SKILL.md:171-180
🌐 Netzwerkzugriff (10)
Geprüft von: codex
30 июн. 2026 г., 04:20
Static command findings mostly point to Markdown examples and belt CLI usage, not hidden Ruby backtick execution. The skill intentionally runs arbitrary Python through an external sandbox and includes network-capable examples, so it should publish with a clear execution and network warning.
1
Gescannte Dateien
188
Analysierte Zeilen
4
Prüfelemente
3
Falschmeldungen ignoriert
Bestätigte Sicherheitsbedenken (2)
Mittel
Arbitrary Python Execution Through External CLI
The skill is designed to send user-provided Python code to infsh/python-executor through the belt CLI. This is legitimate for the skill purpose, but it can run untrusted code and should be restricted to trusted prompts and data.
The allowed tool permits belt commands and the examples pass a code field to infsh/python-executor. The behavior is documented as the main feature, so the risk is real but not malicious by itself.
Mittel
Network-Capable Python Runtime
The skill documents HTTP clients, web scraping, and API calls from the executed Python environment. This can be useful, but it may access external sites or transmit data if a user supplies such code.
The documentation explicitly lists HTTP libraries and includes requests examples to public URLs. No credential exfiltration is shown, but network capability is confirmed.
Statische falsch positive Treffer ignoriert (3)
Diese statischen Treffer wurden durch semantische Prüfung verworfen oder entsprachen reinen Schema-Tokens; daher werden sie aus Transparenzgründen angezeigt, beeinflussen jedoch nicht die Qualitätsbewertung.
Niedrig
Markdown Command Examples Flagged As Backtick Execution
The static Ruby or shell backtick findings refer to Markdown inline code and fenced command examples. They are not embedded executable Ruby backticks, although some examples instruct the agent to run belt commands.
The cited locations are Markdown documentation and command examples in SKILL.md. No standalone script file or Ruby execution context is present.
Niedrig
Weak Cryptography Hit Is A Scanner False Positive
The high blocker at line 3 appears to be triggered by text in the description or URL. No cryptographic algorithm or hashing code is present at that line.
Line 3 is front matter description text that links to inference.sh. I found no MD5, SHA1, DES, or similar weak algorithm usage there.
Niedrig
Network Reconnaissance Hit Is Documentation Text
The reconnaissance finding maps to a note that execution runs in an isolated subprocess. This is descriptive text, not scanning or discovery logic.
Line 165 contains the phrase isolated subprocess and no commands for network scanning. The static finding is not supported by semantic context.
Risikofaktoren
⚙️ Externe Befehle (6)
🌐 Netzwerkzugriff (5)
Erkannte Muster
Bash Tool Access For belt CommandsUser Code Passed To Remote Python AppHTTP Requests From Executed Code
Geprüft von: codex
15 мая 2026 г., 09:15
All 70 static findings are false positives. The backtick execution patterns are markdown code block delimiters and inline code formatting in a documentation file, not actual shell commands. Network URL findings are documentation links and example code snippets. The skill is a legitimate Python executor that runs code in a sandboxed environment via the belt CLI. No malicious intent or deceptive behavior was detected.
1
Gescannte Dateien
188
Analysierte Zeilen
3
Prüfelemente
3
Falschmeldungen ignoriert
Elemente der Fähigkeitsprüfung (1)
Dies sind echte lokale Fähigkeiten, die für diese Fähigkeit erwartet werden können; daher müssen sie überprüft werden, werden jedoch nicht als bestätigtes bösartiges Verhalten gezählt.
Niedrig
Python HTTP Library Import in Example Code
2 findings flagged import requests in example code blocks. These are demonstration snippets showing how to use the executor for web scraping and API calls. The imports appear inside markdown code blocks and are instructional examples, not executable skill code. False positives.
Statische falsch positive Treffer ignoriert (3)
Diese statischen Treffer wurden durch semantische Prüfung verworfen oder entsprachen reinen Schema-Tokens; daher werden sie aus Transparenzgründen angezeigt, beeinflussen jedoch nicht die Qualitätsbewertung.
Niedrig
Markdown Code Blocks Misidentified as Shell Backtick Execution
58 static findings flagged backtick patterns as Ruby/shell command execution. These are actually markdown code block delimiters (```bash, ```json, ```python) and inline code formatting (`library_name`) in a documentation file. No actual shell execution occurs within the skill. All findings are false positives.
Niedrig
Documentation URLs and Example Code URLs Misidentified
7 findings flagged hardcoded URLs as network indicators. These are documentation links to inference.sh and example URLs (example.com, api.github.com) in code demonstration blocks. No malicious or suspicious destinations. All findings are false positives.
Niedrig
Weak Cryptographic Algorithm and Network Reconnaissance False Positives
One finding claimed weak cryptographic algorithm at line 3 (YAML frontmatter description text) and one claimed network reconnaissance at line 165 (documentation text reading 'Safe execution - Runs in isolated subprocess'). Neither finding matches actual file content. Both are scan artifacts with no basis in the file.
Risikofaktoren
⚙️ Externe Befehle (12)
🌐 Netzwerkzugriff (6)
Geprüft von: claude