Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
redis>=5.0.0 python-dotenv>=1.0.0
- Confidence
- 95% confidence
- Finding
- redis>=5.0.0
Security audit
Memory Cache
Security checks across malware telemetry and agentic risk
Overview
The skill appears to be a coherent Redis-backed temporary cache, with dependency hygiene issues but no artifact-backed malicious or hidden behavior.
Before installing, prefer a reviewed lockfile or pinned dependency range, especially for python-dotenv, and configure Redis with appropriate authentication, network exposure, key prefixes, and TTLs so cached data does not persist or leak beyond the intended workspace.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
redis>=5.0.0 python-dotenv>=1.0.0
- Confidence
- 88% confidence
- Finding
- python-dotenv>=1.0.0
Known Vulnerable Dependency: redis — 4 advisory(ies): CVE-2023-28858 (redis-py Race Condition vulnerability); CVE-2023-28859 (redis-py Race Condition due to incomplete fix); CVE-2023-28858 (redis-py before 4.5.3, as used in ChatGPT and other products, leaves a connectio) +1 more
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
- redis
Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )
Low
- Category
- Supply Chain
- Confidence
- 72% confidence
- Finding
- python-dotenv
VirusTotal
66/66 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.