Versioned security assessment

Report ID: SA-A0668140

7/6/2026, 2:56:48 PM

python-executor security assessment v3

Skill Security Certification Report

Audit History
Audit model: codex Historical report
Skill name
python-executor
Version
v3
Maintainer
inference-sh-9
Source
github.com/inference-sh-9/skills/tree/main/skills/python-executor/
Coverage
1 Files scanned · 184 Lines analyzed
Policy version
Unavailable

Highest confirmed finding severity

Critical

2 confirmed security findings require attention.

Installation context

Historical evidence

This report may not describe the currently installable artifact. Open the current Skill page for install guidance.

Open current Skill page

This report does not block or authorize the manifest or ZIP.

The critical pipe-to-shell installer on SKILL.md line 16 is confirmed and should block automatic publication until removed. Most external command alerts are Markdown formatting false positives, while the remaining confirmed issues reflect outbound HTTP examples and third-party Python execution.

Report position

Historical report

Open audit history before using this report to install.

Audit attestation

Not attestable

The required immutable binding is incomplete.

Human verification

Not verified

No human verification is recorded for this report.

Coverage

1 Files scanned · 184 Lines analyzed

8 items shown for review

Limitations

This report does not claim runtime or sandbox execution and does not prove the absence of side effects.

Evidence chain

Follow the evidence from source binding to the install contract. Available evidence supports verification; it is not a safety guarantee.

  1. Source

    Binding unavailable

  2. Artifact

    Identity incomplete

  3. Audit

    Complete

  4. Install contract

    Open manifest to verify

    Open manifest

Capabilities observed

Observed means this report recorded supporting evidence. Not recorded does not prove that a capability is absent.

Contains scripts

May execute code included with the Skill.

Not recorded by this audit

Network access

May connect to external services.

Observed in 9 evidence locations

Filesystem access

May read or write local files.

Not recorded by this audit

Env variables

May read values from the process environment.

Not recorded by this audit

External commands

May invoke commands or programs outside the Skill.

Observed in 40 evidence locations

Capability review items (6)
Critical
SKILL.md:16
Hardcoded URL
curl -fsSL https://cli.inference.sh | sh && infsh login
The hardcoded URL on line 16 is downloaded and piped to a shell. That makes the external endpoint part of an executable installation path, not a passive documentation link.
Low
SKILL.md:81
Python HTTP libraries
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
SKILL.md:122
Python HTTP libraries
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
SKILL.md:3
Hardcoded URL
description: "Execute Python code in a safe sandboxed environment via [inference.sh](https://inferen
The description identifies inference.sh as the external execution service for this skill. This is an expected dependency, but it confirms a third-party network boundary for user code.
Low
SKILL.md:81
Hardcoded URL
"code": "import requests\nfrom bs4 import BeautifulSoup\n\nresponse = requests.get(\"https://example
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.
Low
SKILL.md:122
Hardcoded URL
"code": "import requests\nimport json\n\nresponse = requests.get(\"https://api.github.com/users/octo
The example Python code performs outbound HTTP requests for scraping or API access. The endpoints are public examples, but the skill clearly supports external network activity.

Risk findings

Confirmed security concerns are separated from items that still need review.

Confirmed security concerns (2)

RISK-001 Critical
SKILL.md:16
Pipe to shell pattern
curl -fsSL https://cli.inference.sh | sh && infsh login
Line 16 pipes a remote installer script directly into sh before running a login command. This creates a supply-chain execution risk because the script is executed before local verification.
RISK-002 High
SKILL.md:3SKILL.md:35-43SKILL.md:157
Third-Party Arbitrary Python Execution
The skill accepts user-provided Python code and sends it to the infsh/python-executor service for execution. This can expose sensitive code, data, or credentials supplied in prompts.
The description, input schema, and use cases show arbitrary Python submitted to a third-party execution app. The risk is intentional functionality, not hidden malware, so confidence is high rather than absolute.

Remediation

Suggested fixes recorded by this audit. Applying them is the maintainer’s responsibility.

  1. FIX-001
    Critical
    Remote installer is piped directly into a shell.
    Replace curl pipe-to-shell instructions with a manual download, checksum verification, and a separate install command.
  2. FIX-002
    High
    User Python code is executed by a third-party service.
    Add clear warnings to avoid secrets and document isolation, retention, and network egress controls.
  3. FIX-003
    Low
    Examples encourage outbound HTTP requests.
    State that users must follow site policies and avoid sending credentials or private data to external endpoints.

Expert evidence

Immutable subject identity, scanner metadata, dismissed matches, and source-level evidence.

Artifact subject

Marketplace commit
Unavailable
Content hash
Unavailable
Tree hash
Unavailable
Skill path
Unavailable
Audit payload hash
Unavailable

Analysis metadata

Audit model: codex

Analysis state: Complete

Scope is limited to the recorded files, lines, methods, and evidence. No runtime or sandbox execution is claimed.

Verify and export

JSON report CITATION.cff SARIF 2.1.0 Signed installation manifest

The manifest and lockfile bind install artifacts to cryptographic hashes. This integrity claim is separate from the security assessment.

Audit attestation: not_attestable