Price Arbitrage Finder

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:20 AM UTC
• Version: 1.0.0

Overview

This skill is a Chinese-language price comparison helper with a small disclosed Python dependency and no executable payload or hidden behavior in the artifact.

Before installing, consider that it is written for Chinese-speaking users and Chinese e-commerce platforms. The unpinned requests dependency should ideally be pinned or lockfile-managed, but the reviewed artifact does not show hidden data access, persistence, destructive behavior, or exfiltration.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–18
Vulnerability Type: Unpinned package dependency
Risk Level: Medium

yaml

"kind": "pip",
"package": "requests",
"label": "安装依赖：pip3 install requests",

Technical Analysis

The skill metadata instructs the package manager to install requests without specifying an exact version or an integrity hash. Consequently, installation resolves whichever version is available from the configured Python package index at that time.

Although requests is a conventional package name and the reviewed metadata does not specify a suspicious repository, leaving the version and artifact integrity uncontrolled creates supply-chain exposure. A compromised upstream release, package index, mirror, or package-resolution configuration could cause an altered artifact to be installed. The dependency is also not justified by the reviewed project contents because the package contains no executable source code that imports or uses it.

Attack Path

1. A user or automated skill installer processes the installation metadata.
2. The installer runs the equivalent of pip3 install requests.
3. The package manager resolves an uncontrolled package version from its configured registry or mirror.
4. If the registry, mirror, resolved release, or local package-resolution configuration has been compromised, a malicious artifact is downloaded and installed.
5. Attacker-controlled code may execute through package installation behavior or when the compromised package is subsequently imported and used.

Impact Assessment

Successful exploitation could execute code with the privileges of the account performing the installation or running the skill. The resulting scope may include access to that account's files, environment variables, network permissions, and other resources available to the Python process. No evidence in the reviewed project demonstrates privilege escalation, persistence, credential theft, or a ...[truncated 76 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the requests dependency until executable functionality genuinely requires it.
2. If required, pin it to an exact, security-reviewed version rather than allowing unconstrained resolution.
3. Maintain a lock file containing transitive dependency versions and cryptographic hashes.
4. Require hash-verified installation, such as pip's --require-hashes mode.
5. Install packages only from an explicitly trusted registry over authenticated TLS, and restrict unapproved mirrors or index overrides.
6. Add automated dependency vulnerability and integrity scanning to the release process.
7. Periodically update the pinned version through a controlled review and testing workflow.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file’s user-facing description, usage examples, and warnings are all presented in Chinese, and there is no indication that users can choose another language or that the locale restriction is required. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.