mcp-code-execution-mode
Warn
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONDYNAMIC_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill's primary function is the dynamic execution of Python code provided by the agent. Additionally, the troubleshooting section recommends using 'pickle.load' for session persistence, which is a known insecure deserialization vector.
- [COMMAND_EXECUTION]: The skill facilitates the execution of shell commands using the 'subprocess' module within the sandboxed environment, as demonstrated in the 'Bash Commands' pattern.
- [EXTERNAL_DOWNLOADS]: The installation process involves downloading a Python package from PyPI and cloning a repository from GitHub ('github.com/elusznik/mcp-server-code-execution-mode.git').
- [INDIRECT_PROMPT_INJECTION]: The skill processes data from external MCP servers (e.g., GitHub, Slack) which could contain malicious instructions designed to influence the Python code execution flow.
- Ingestion points: Data fetched from proxied MCP tools via 'mcp_servers' or attribute access in 'SKILL.md'.
- Boundary markers: No specific delimiters or instructions to ignore embedded content are provided for the data returned by proxied tools.
- Capability inventory: The skill has the ability to execute arbitrary Python code, run shell commands, write to the '/tmp' directory, and call other tools (e.g., GitHub, Slack, Filesystem).
- Sanitization: The primary security measure is the use of Podman or Docker for container-level isolation.
Audit Metadata