isnad-scan

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:18 PM UTC
• Version: 1.0.0

Overview

The skill appears to do what it says, but it installs a third-party scanner package whose exact version is not fixed.

Install only if you trust the isnad-scan package source, prefer a pinned or reviewed package version where possible, and run scans on the specific directories you intend to inspect. Treat optional CVE checks as network-using behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

Unpinned Third-Party Executable Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 9-14
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

yaml

install:
  - id: isnad-scan-pip
    kind: pipx
    package: isnad-scan
    bins: ["isnad-scan"]
    label: "Install isnad-scan (pipx)"

Technical Analysis

The skill delegates its entire operation to the third-party isnad-scan package installed through pipx. The dependency has no exact version constraint, cryptographic hash, or other integrity control. Consequently, separate installations can resolve to different package releases even though the reviewed skill file remains unchanged.

Installing a Python package may execute package-controlled build or installation logic. Invoking the resulting CLI also executes code that is not included in this project and therefore could not be inspected during this audit. The documented commands pass user-selected directory paths to that executable, potentially exposing all files readable by the invoking account within the selected directory.

This is a supply-chain exposure rather than evidence that the currently published package is malicious. The reviewed project contains no vendored implementation with which to validate the scanner's claimed behavior.

Attack Path

1. An attacker compromises the package publisher account, release process, distribution channel, or a future release of isnad-scan.
2. The attacker publishes a malicious package version under the same package name.
3. A user installs this skill, and the unpinned dependency resolves to the attacker-controlled version.
4. Malicious code can run during package installation or when the user invokes isnad-scan.
5. When invoked with a target path, the compromised executable can inspect files accessible to the user's account and may misuse them, subject to the host's process permissions and network restrictions.

Impact Assessment

Exploi ...[truncated 433 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin isnad-scan to an exact, reviewed version rather than resolving the latest available release.
2. Enforce cryptographic hashes for the package and all transitive dependencies using a locked dependency manifest or equivalent verified installation workflow.
3. Validate package provenance through a trusted registry, signed releases, attestations, and a documented publisher identity.
4. Review and retain the source corresponding to the pinned release so its installation and runtime behavior can be independently audited.
5. Perform dependency updates through a controlled review process with automated integrity and vulnerability checks.
6. Run the scanner in a sandbox with read-only access limited to the intended target and deny unnecessary access to credentials, unrelated files, and outbound networking.
7. Prefer isolated, non-privileged execution and never install or run the package as an administrator unless strictly required.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

**Code Injection** — shell execution, eval, exec, subprocess, os.system, dynamic imports
**Prompt Injection** — role override attempts, instruction hijacking, jailbreak patterns
**Credential Exfiltration** — env var harvesting, keychain access, token theft, file reads of sensitive paths
**Network Threats** — reverse shells, DNS exfiltration, unauthorized outbound connections, webhook data leaks
**Filesystem Attacks** — path traversal, symlink attacks, /etc/passwd reads, SSH key access
**Supply Chain** — typosquatting detection, minified JS analysis, binary file scanning, hidden files

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

**Prompt Injection** — role override attempts, instruction hijacking, jailbreak patterns
**Credential Exfiltration** — env var harvesting, keychain access, token theft, file reads of sensitive paths
**Network Threats** — reverse shells, DNS exfiltration, unauthorized outbound connections, webhook data leaks
**Filesystem Attacks** — path traversal, symlink attacks, /etc/passwd reads, SSH key access
**Supply Chain** — typosquatting detection, minified JS analysis, binary file scanning, hidden files
**Crypto Risks** — weak algorithms, hardcoded keys, wallet seed extraction

Static analysis

No suspicious patterns detected.