📦
Audit History
python-executor - 4 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 4 Latest
Jul 6, 2026, 02:56 PM
The critical pipe-to-shell installer on SKILL.md line 16 is confirmed and should block automatic publication until removed. Most external command alerts are Markdown formatting false positives, while the remaining confirmed issues reflect outbound HTTP examples and third-party Python execution.
1
Files scanned
184
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (2)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
Line 16 pipes a remote installer script directly into sh before running a login command. This creates a supply-chain execution risk because the script is executed before local verification.
High
Third-Party Arbitrary Python Execution
The skill accepts user-provided Python code and sends it to the infsh/python-executor service for execution. This can expose sensitive code, data, or credentials supplied in prompts.
The description, input schema, and use cases show arbitrary Python submitted to a third-party execution app. The risk is intentional functionality, not hidden malware, so confidence is high rather than absolute.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The hardcoded URL on line 16 is downloaded and piped to a shell. That makes the external endpoint part of an executable installation path, not a passive documentation link.
Low
Python HTTP libraries
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
Python HTTP libraries
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
Hardcoded URL
description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen
The description identifies inference.sh as the external execution service for this skill. This is an expected dependency, but it confirms a third-party network boundary for user code.
Low
Hardcoded URL
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
Hardcoded URL
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Risk Factors
⚙️ External commands (40)
SKILL.md:15-22 SKILL.md:22-24 SKILL.md:24-30 SKILL.md:30-37 SKILL.md:37-44 SKILL.md:44-49 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52-55 SKILL.md:55 SKILL.md:56 SKILL.md:59 SKILL.md:60 SKILL.md:63-64 SKILL.md:64 SKILL.md:65-68 SKILL.md:68 SKILL.md:69 SKILL.md:72 SKILL.md:73 SKILL.md:79-83 SKILL.md:83-87 SKILL.md:87-91 SKILL.md:91-95 SKILL.md:95-99 SKILL.md:99-103 SKILL.md:103-108 SKILL.md:108-112 SKILL.md:112-116 SKILL.md:116-120 SKILL.md:120-124 SKILL.md:124-128 SKILL.md:128-130 SKILL.md:130-136 SKILL.md:136-140 SKILL.md:140-146 SKILL.md:146-163 SKILL.md:163 SKILL.md:168-177
🌐 Network access (11)
Detected Patterns
Pipe to shell pattern
Audited by: codex
Jul 6, 2026, 02:56 PM
The critical pipe-to-shell installer on SKILL.md line 16 is confirmed and should block automatic publication until removed. Most external command alerts are Markdown formatting false positives, while the remaining confirmed issues reflect outbound HTTP examples and third-party Python execution.
1
Files scanned
184
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (2)
Critical
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
Line 16 pipes a remote installer script directly into sh before running a login command. This creates a supply-chain execution risk because the script is executed before local verification.
High
Third-Party Arbitrary Python Execution
The skill accepts user-provided Python code and sends it to the infsh/python-executor service for execution. This can expose sensitive code, data, or credentials supplied in prompts.
The description, input schema, and use cases show arbitrary Python submitted to a third-party execution app. The risk is intentional functionality, not hidden malware, so confidence is high rather than absolute.
Capability review items (6)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The hardcoded URL on line 16 is downloaded and piped to a shell. That makes the external endpoint part of an executable installation path, not a passive documentation link.
Low
Python HTTP libraries
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
Python HTTP libraries
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
Hardcoded URL
description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen
The description identifies inference.sh as the external execution service for this skill. This is an expected dependency, but it confirms a third-party network boundary for user code.
Low
Hardcoded URL
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
Hardcoded URL
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Risk Factors
⚙️ External commands (40)
SKILL.md:15-22 SKILL.md:22-24 SKILL.md:24-30 SKILL.md:30-37 SKILL.md:37-44 SKILL.md:44-49 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52-55 SKILL.md:55 SKILL.md:56 SKILL.md:59 SKILL.md:60 SKILL.md:63-64 SKILL.md:64 SKILL.md:65-68 SKILL.md:68 SKILL.md:69 SKILL.md:72 SKILL.md:73 SKILL.md:79-83 SKILL.md:83-87 SKILL.md:87-91 SKILL.md:91-95 SKILL.md:95-99 SKILL.md:99-103 SKILL.md:103-108 SKILL.md:108-112 SKILL.md:112-116 SKILL.md:116-120 SKILL.md:120-124 SKILL.md:124-128 SKILL.md:128-130 SKILL.md:130-136 SKILL.md:136-140 SKILL.md:140-146 SKILL.md:146-163 SKILL.md:163 SKILL.md:168-177
🌐 Network access (11)
Detected Patterns
Pipe to shell pattern
Audited by: codex
Jun 30, 2026, 04:01 AM
The static external-command results are mostly false positives from Markdown code fences, inline package names, and CLI examples. The pipe-to-shell quick start is a confirmed high-risk supply-chain pattern, while the network examples are intentional capabilities for scraping and API calls. No prompt injection text or confirmed malicious intent was found, so this is not a critical block.
1
Files scanned
184
Lines analyzed
6
Review items
4
False positives ignored
Confirmed security concerns (3)
High
Remote Install Script Piped to Shell
The quick start recommends `curl -fsSL https://cli.inference.sh | sh && infsh login`. Piping a remote script directly into a shell can execute changed or compromised installer content before review. The later checksum note does not remove this risk because the repository does not include the installer logic for local verification.
The exact pipe-to-shell command is visible in the quick start. This is a well-known supply-chain execution risk even when the service itself may be legitimate.
Medium
Hosted Arbitrary Python Execution Capability
The skill is designed to send user-provided Python code to the `infsh/python-executor` app. This is the core feature, but it can process sensitive data and produce files, so users need clear trust boundaries for the hosted sandbox.
The input schema and examples show arbitrary Python code supplied as input and output files returned from `outputs/`. Legitimate sandbox execution is possible, but data exposure risk remains.
Medium
Network-Enabled Scraping and API Examples
The skill documents installed HTTP clients and includes examples that fetch web pages and call external APIs. This appears intentional and useful, but it can transmit user data to third-party services if prompts include secrets or private content.
The network libraries and request examples are explicit. They are not inherently malicious, but they create a real exfiltration path when users run unreviewed code.
Static false positives ignored (4)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Markdown Backticks Misclassified as Ruby Execution
Most static external-command hits come from fenced Markdown examples and inline package names, not Ruby backtick execution. These examples still show CLI use, but the Ruby-specific finding is a false positive.
The surrounding lines are Markdown code fences and shell examples in SKILL.md. No Ruby source file or Ruby backtick operator is present.
Low
Documentation URLs and Image Link
Several hardcoded URLs point to the service site, a hosted image, documentation, and a checksum page. These links are expected documentation content, not hidden callbacks or credential exfiltration code.
The URLs are visible in descriptive text and Markdown links. No evidence found that these links automatically transmit secrets from the user environment.
Low
Weak Cryptography Pattern Not Confirmed
The weak cryptographic algorithm hit at the description line appears to be a pattern collision with service text or the `.sh` domain. The only explicit cryptographic statement is SHA-256 checksum verification in the install note.
No MD5, SHA-1, DES, or similar weak algorithm appears in the reviewed context. The file instead mentions SHA-256 verification on line 24.
Low
Network Reconnaissance Not Confirmed
The network reconnaissance hit maps to the safe-execution note and nearby general documentation, not scanning code. No evidence found of port scanning, host discovery, or probing logic in the skill file.
The referenced lines contain user-facing notes about CPU-only execution, isolated subprocesses, plotting, and output files. They do not contain reconnaissance commands or code.
Risk Factors
⚙️ External commands (6)
🌐 Network access (7)
📁 Filesystem access (4)
Detected Patterns
Pipe Remote Installer to ShellAgent-Accessible External CLI Command
Audited by: codex
Feb 27, 2026, 08:52 AM
Static analysis flagged 72 patterns but most are false positives. The 'external_commands' detections are bash code examples in markdown documentation, not actual shell execution. Network URLs point to the legitimate inference.sh service. The skill executes code on a remote sandboxed service, not locally. Low risk assigned due to third-party service dependency and ability to run arbitrary user code remotely.
1
Files scanned
184
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Pipe to Shell Installation Pattern
The install command uses curl piped to sh (curl | sh) which can be risky if the server is compromised. This is a common pattern for CLI tools but users should be aware of the trust model.
Clear evidence of curl | sh pattern at line 16. This is standard for CLI distribution but carries inherent supply chain risk.
Low
Third-Party Code Execution Service
The skill relies on inference.sh remote service for code execution. Users must trust the service provider with their code and any data processed.
Documentation explicitly states code runs on inference.sh service. This is disclosed and expected behavior for this skill type.
Low
Network Access for Web Scraping
The skill supports web scraping and API calls using requests library. This is intended functionality but could be used to access external services.
Examples at lines 79-83 and 121-124 show HTTP requests to external URLs. This is documented capability, not hidden behavior.
Risk Factors
⚙️ External commands (10)
🌐 Network access (7)
Audited by: claude