spclib
Warn
Audited by Gen Agent Trust Hub on Apr 14, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [COMMAND_EXECUTION]: The library provides the
sp_ps_runandsp_ps_spawnAPIs, which allow the agent to execute arbitrary shell commands on the host system. These functions are documented inSKILL.mdandreferences/index.mdas standard components of the process management module. - [REMOTE_CODE_EXECUTION]: The file
references/example/freestanding/jit.ccontains a functional implementation of a JIT compiler. This code demonstrates the dynamic generation of x86_64 machine code and its execution via memory allocated withSP_PROT_EXEC(executable) permissions. This pattern of runtime code generation and execution is a classic dynamic execution vector. - [DATA_EXFILTRATION]: The library includes APIs that create a broad surface for data exposure, specifically
sp_io_read_filefor reading arbitrary files,sp_fs_list_dir_recursivefor full filesystem traversal, andsp_env_get_allfor retrieving all environment variables. These tools can be used to harvest sensitive data or credentials from the host environment.
Audit Metadata