Python Coding Guidelines

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:55 AM UTC
• Version: 1.0.0

Overview

This Python guidance skill is coherent and low risk, with only a standard caution around generic dependency installation examples.

Before using the dependency-install snippet, confirm the exact package name and source, prefer a project virtual environment or lock file, and avoid installing packages you have not reviewed. The rest of the skill is ordinary Python coding guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–57
Vulnerability Type: Supply-chain exposure through unverified dependency installation
Risk Level: Medium

bash

# Prefer uv if available
if command -v uv &>/dev/null; then
    uv pip install <package>
    uv pip compile requirements.in -o requirements.txt
else
    pip install <package>
fi

Technical Analysis

The Skill instructs the agent to install an unspecified package from the package manager's implicitly configured indexes. It does not require version pinning, integrity hashes, provenance verification, a trusted explicit index, or user approval.

Installing a Python distribution can execute package-controlled build or installation logic. Consequently, a malicious, compromised, typo-squatted, or dependency-confusion package could execute code with the same operating-system privileges and environment access as the agent. Generic package installation is broader than the minimum privileges needed to provide Python coding guidelines.

The static pre-scan warning about sending sensitive information over the network was also reviewed. The file contains no instruction to transmit credentials, private keys, environment variables, project files, or other sensitive data. Network access is implicit only in retrieving dependencies through uv or pip.

Attack Path

1. An attacker influences a package name, dependency declaration, package-index configuration, or related user request.
2. The agent follows the Skill's generic uv pip install <package> or pip install <package> guidance.
3. The package manager contacts its configured index and retrieves an attacker-controlled or compromised distribution.
4. Package build or installation hooks execute in the agent's environment.
5. The malicious package can access resources available to the agent and may modify project or environment files.

Impact Assessment

Successful exploitatio ...[truncated 452 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval before installing or updating any dependency.
• Validate the exact package name and use an explicitly trusted package index.
• Pin exact versions in a reviewed lock file.
• Require cryptographic hashes where supported, such as pip's --require-hashes.
• Separate dependency resolution from installation and review the resolved dependency graph first.
• Install packages only inside an isolated, least-privileged virtual environment or sandbox.
• Disable unnecessary network access and build isolation exceptions.
• Prefer vetted binary distributions where appropriate and review packages that require local build hooks.
• Replace the generic installation example with a safe workflow that verifies package identity, source, version, and integrity before execution.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.