eval-generator-gen-pages

The skill contains multiple critical security vulnerabilities in its own implementation, specifically regarding dynamic code execution and potential command injection.

The skill content explicitly includes findings for 'js-eval-injection' (use of eval/Function constructor with dynamic input) and 'AISEC_BEHAVIOR_JS_CHILD_PROCESS_IMPORT' (use of child_process for OS command execution).

Skill name or description references a well-known AI brand, which may suggest impersonation.

claude

Detected use of eval() or Function() constructor with dynamic input. This can lead to code injection if the input is user-controlled. Avoid eval() entirely. Use JSON.parse() for data deserialization or a safe expression evaluator for computed values. (seen 3 times in this file at lines 108, 112, 116)

eval()

Detected use of eval() or Function() constructor with dynamic input. This can lead to code injection if the input is user-controlled. Avoid eval() entirely. Use JSON.parse() for data deserialization or a safe expression evaluator for computed values.

eval(s)

An exported function constructs a shell command by concatenating a parameter value and passes it to a command execution function. Callers passing user-controlled data will produce a command injection vulnerability. Use parameterized APIs or validate input.

taint source (line 73): s: any → sink: eval(s)

Detected use of eval() or Function() constructor with dynamic input. This can lead to code injection if the input is user-controlled. Avoid eval() entirely. Use JSON.parse() for data deserialization or a safe expression evaluator for computed values.

eval()

JavaScript dynamic code execution (new Function / setTimeout/setInterval with a string body) (seen 2 times in this file at lines 739, 977)

new Function(

presence-runner.ts dynamically imports every *.check.ts file it finds in the presence/ directory via `await import(pathToFileURL(file).href)`. Since the agent itself writes these files in Step 4, a prompt injection in the user's .tsx source could cause the agent to embed malicious code in the check files, which then executes with full Node.js privileges when the runner imports them.

const mod = await import(pathToFileURL(file).href); const result = mod.check();

The `run` function in `evals/runner/run-evals.ts` uses `execSync` to execute arbitrary commands provided as strings, which could be manipulated if the input path or environment is controlled by an attacker.

execSync(cmd, { cwd: ROOT, encoding: 'utf-8', stdio: 'pipe' });

child_process module imported — any exec/execSync/spawn call executes OS commands

import { execSync, execFileSync } from 'child_process';

The skill constructs file paths using `join(ROOT, ...)` where `ROOT` is derived from the current working directory, potentially allowing access to files outside the intended project directory if the user-provided path is malicious.

const ROOT = join(__dirname, '..', '..');

The skill performs recursive globbing and file reading across the entire project directory, which may include sensitive configuration files or credentials not related to the generative page.

const srcFiles = globSync(`${ROOT}/**/*.ts?(x)`, { ignore: `${ROOT}/evals/**` });

run-evals.ts passes commands to execSync with cwd set to ROOT, which is derived from __dirname path traversal. If a malicious .tsx file causes the agent to write a crafted manifest.json with a project name containing shell metacharacters, and that value is later interpolated into a shell command, it could enable command injection through the eval pipeline.

execSync(cmd, { cwd: ROOT, encoding: 'utf-8', stdio: 'pipe' }) where ROOT = join(__dirname, '..', '..')

Skill executes commands, writes files, or accesses the network but declares no allowed-tools, so its tool surface cannot be reviewed or constrained.