T08 · Insecure Dependencies
Warning
- Location
continuous_learner.py:7- Finding
Unsafe Import-Path Precedence Enables Local Dependency Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Continuous Learner
Security checks for vulnerabilities and agentic risk
Overview
This skill needs Review because it runs an unbundled local Python module outside the reviewed package while offering pipeline and continuous-learning behavior.
Install only if you trust and control the external continuous_learner.py implementation in the referenced db location. Review that external file, lock down write access to its directory, and use explicit run/status commands rather than broad triggers or daemon mode unless you understand the ongoing background activity.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill exposes a "daemon" mode that starts continuous background operation, but the description does not clearly warn users about persistence, repeated execution, or resource/network effects. This makes accidental long-running activation more dangerous because users may not realize the skill can continue operating autonomously after invocation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrase list includes the generic term "pipeline," which is common in ordinary conversation and unrelated workflows. Overly broad triggers can cause accidental invocation of a skill that performs multi-stage ingestion, skill generation, and daemon-capable automation, increasing the chance of unintended actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The module title and docstrings are written entirely in Chinese and present the skill as a localized capability, but there is no indication that users can opt into another language. The policy requires avoiding forced language or locale constraints unless the choice is offered or the constraint is clearly justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
The primary description is presented in Chinese while other parts of the file are in English, but the skill does not state any language-selection behavior or user opt-in. This can create an implicit language policy issue if the skill defaults to one language without user choice.
- Content
Static analysis
No suspicious patterns detected.