python-executor
Fail
Audited by Gen Agent Trust Hub on Mar 20, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill's documentation includes a setup command that pipes a script from a remote URL (https://cli.inference.sh) directly into the shell (sh). This is a high-risk pattern that executes unverified remote code on the local host.\n- [EXTERNAL_DOWNLOADS]: The installation process fetches binary files from dist.inference.sh. While the documentation mentions checksum verification, the initial execution of the installation script happens before any such verification can be manually performed by the user.\n- [COMMAND_EXECUTION]: The skill uses the infsh command to execute arbitrary Python code. This capability allows the agent to run complex logic, perform network operations, and manipulate files within the remote environment, which could be exploited if malicious code is provided.\n- [PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it executes arbitrary code passed through the code parameter. \n
- Ingestion points: The code field in the input schema (SKILL.md).\n
- Boundary markers: No specific boundary markers or instructions are used to distinguish between intended code and potentially malicious instructions embedded in data.\n
- Capability inventory: The Python execution environment has broad capabilities, including network access via libraries like requests and playwright, and file system access within its sandbox.\n
- Sanitization: The skill does not perform any validation or sanitization of the input code before execution.
Recommendations
- HIGH: Downloads and executes remote code from: https://cli.inference.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata