azure-ai-agents-python
Fail
Audited by Gen Agent Trust Hub on Jun 20, 2026
Risk Level: CRITICALCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill documentation includes multiple examples (in references/async-patterns.md and references/tools.md) of a calculator tool that uses the dangerous eval() function.
- Evidence: Found in the 'Complete Example' sections:
def calculate(expression: str) -> str: return str(eval(expression)). - Impact: The eval() function executes arbitrary Python code. An attacker can provide a string that imports modules like 'os' or 'subprocess' to execute system-level commands, leading to full system compromise.
- [REMOTE_CODE_EXECUTION]: Because this tool is designed to be called by an AI agent processing user input, it creates a path for remote code execution.
- Ingestion points: The skill uses
client.messages.createto receive user messages, which are then processed by the agent. - Boundary markers: None are provided in the examples to prevent the LLM from executing malicious payloads.
- Capability inventory: The calculator tool provides direct access to Python's execution engine.
- Sanitization: No input validation or sanitization is performed on the 'expression' string before it is passed to eval().
Recommendations
- AI detected serious security threats
Audit Metadata