confluence-publish

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 9:31 PM UTC
• Version: 1.0.2

Overview

This is a disclosed Confluence publishing skill that can create or update pages using your Atlassian API token, so users should verify the target space and title before running it.

Install only if you intend to let the skill write to Confluence. Use a scoped Atlassian API token, confirm the tenant, space key, and page title before publishing, and be aware that an existing page with the same title will be updated. Prefer a locked dependency set before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Runtime Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Uncontrolled dependency versions and unnecessary production dependency
Risk Level: Low

Vulnerable Code:

text

requests>=2.28.0
pytest>=7.0.0

Technical Analysis

Both dependencies use open-ended minimum-version constraints. Consequently, separate installations can resolve to different, unreviewed future releases, making builds non-reproducible and increasing exposure to supply-chain compromise or unexpected security regressions. No package integrity hashes or lock file are provided to verify downloaded artifacts.

In addition, pytest is used only by the test suite but is listed as a runtime dependency. Installing it in production unnecessarily expands the dependency tree and the amount of third-party code present in the runtime environment.

This finding does not establish that the currently available requests or pytest packages are malicious. The risk arises because the dependency policy permits installation of future releases without an explicit review or integrity check.

Attack Path

1. An attacker compromises a permitted dependency release, its distribution account, or an upstream component resolved through its dependency tree.
2. A future installation resolves the open-ended constraint to the compromised release.
3. Because no exact version or artifact hash is enforced, the package manager accepts and installs that release.
4. Attacker-controlled package code may execute during installation or when the dependency is imported or invoked.
5. The code then operates with the privileges and environment access granted to the Skill process.

Impact Assessment

Successful exploitation could execute code with the privileges of the account or container installing or running the Skill. Depending on deployment controls, this could expose environment variables—including Confluence credentials—workspa ...[truncated 270 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each production dependency to an explicitly reviewed version, for example:

   text

   requests==<reviewed-version>
   

2. Generate and verify cryptographic hashes for all production packages and transitive dependencies, such as by using pip-compile --generate-hashes and installing with pip --require-hashes.
3. Maintain a lock file or fully pinned constraints file to ensure reproducible builds.
4. Move pytest into a separate development or test dependency file so it is not installed in production.
5. Add automated dependency vulnerability scanning and controlled update reviews to CI.
6. Rebuild and redeploy from trusted package indexes whenever approved dependency versions or hashes change.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Metadata comment format:

html

<!--
{"space_key":"SPACE","page_title":"My Page","parent_page_id":"12345"}
-->
<h1>Body content</h1>

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The markdown states that the skill can create or update Confluence pages via the REST API, which is a remote write operation affecting external user content. While the behavior is described functionally, there is no explicit warning that invoking publish_page will modify content in Confluence or may overwrite an existing page with the same title.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill performs a state-changing remote action by creating or updating Confluence pages, but the action description does not prominently warn users that invoking it will modify external content. This can lead to accidental publication or overwriting of pages if an agent or user treats the skill like a read-only integration.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a lower-bound only (requests>=2.28.0), which makes builds non-reproducible and can allow installation of unexpected future versions or vulnerable intermediary versions depending on the environment. While this file alone does not prove exploitation, unpinned dependencies are a genuine supply-chain hygiene weakness and make it difficult to verify whether known-fixed versions are consistently used.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.28.0
pytest>=7.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

requests has multiple known advisories, and because the manifest does not pin a specific version, there is no way to verify from this file whether a safe or affected release will be installed. In skill context, requests is a runtime network library, so unresolved version selection is more dangerous than a purely local package because vulnerable versions could affect outbound HTTP behavior, credential handling, or TLS-related security properties.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

pytest is also unpinned, so installs may resolve to different versions over time and across environments. Even though pytest is commonly a development dependency, leaving it unpinned still weakens reproducibility and can introduce known-vulnerable or breaking versions into CI or test environments.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

requests>=2.28.0
pytest>=7.0.0

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 75% confidence

Finding

pytest has known advisories, and the absence of version pinning means the installed version cannot be verified as safe. The risk is somewhat reduced because pytest is typically used in development or CI rather than production runtime, but compromised or vulnerable test tooling can still affect build integrity, temporary file handling, or developer systems.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · src/main.py (reported line 323)May include surrounding context.

python

def process(self, action: str, input_data: str, config: Dict[str, Any]) -> Dict[str, Any]:
        if action not in self.ACTIONS:
            raise ValueError(f"Unknown action: {action}. Available: {self.ACTIONS}")
        return getattr(self, action)(input_data=input_data, config=config)


def handler(event: Dict[str, Any], context: Any = None) -> Dict[str, Any]:

Static analysis

No suspicious patterns detected.