Security audit

ML Experiment Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent ML experiment planning helper, with ordinary file output behavior and a couple of implementation caveats users should understand.

Installers and users should expect this skill to run a local Python script that reads an optional JSON experiment definition and writes an output artifact. Avoid feeding attacker-controlled values into CSV exports that will be opened in spreadsheets, and do not rely on --dry-run to avoid filesystem changes unless the script is fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/build_experiment_plan.py:53
Finding: CSV Formula Injection Through Untrusted Experiment Fields
Content: View full analysis
Remediation: View remediation
str: text = str(value) probe = text.lstrip(" \t\r\n") if probe.startswith(("=", "+", "-", "@")): return "'" + text return text ``` All dynamic cells should pass through this function before being supplied to `writer.writerow()`. Because spreadsheet behavior differs among products, the implementation should also be validated against every spreadsheet application the project supports. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/build_experiment_plan.py:101
Finding: Dry-Run Mode Performs Documented Filesystem Side Effects
Content: View full analysis
None: output_path.parent.mkdir(parents=True, exist_ok=True) ``` The function is then called unconditionally, regardless of `args.dry_run`: ```python render(result, Path(args.output), args.format) ``` The flag is only included as metadata in the generated result: ```python "dry_run": args.dry_run, ``` ### Technical Analysis The implementation violates the explicit security expectation established by the `--dry-run` help text. Setting the flag does not alter control flow: `render()` still creates parent directories and writes or replaces the selected output file. Because `--output` is mandatory and converted directly into a `Path`, a caller who relies on dry-run mode can unintentionally modify any filesystem path writable by that caller. This does not bypass operating-system permissions and does not independently escalate privileges. However, it can overwrite an existing writable file with JSON, Markdown, or CSV content despite the user's explicit request for an operation without side effects. ### Attack Path 1. A user, automation system, or agent invokes the script with `--dry-run`, expecting validation or preview behavior only. 2. The invocation specifies an existing writable file or a path whose parent directory does not yet exist. 3. The script builds the plan and records `dry_run: true` in its metadata. 4. The unconditional call to `render()` creates parent directories and writes or overwrites the output path. 5. ...[truncated 840 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill references executable and file-capable resources (scripts/build_experiment_plan.py and a reference file) but does not declare any tool scope such as permissions or allowed-tools. This creates an implicit capability boundary, making it easier for an agent or integrator to grant broader file access than intended and harder to enforce least privilege consistently.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.