Python Testing

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:14 AM UTC
• Version: 1.0.0

Overview

This is a coherent Python testing reference skill with ordinary pytest examples and no hidden execution, persistence, or data exfiltration behavior.

Safe to install as a testing cheat sheet. Before copying commands, install dependencies in a virtual environment and pin versions for projects with stronger supply-chain requirements.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/async.md:5

Finding

Unpinned pytest-asyncio Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/async.md:5-7
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

pip install pytest-asyncio

Technical Analysis

The documentation instructs users or an AI agent to install pytest-asyncio without a version constraint, lockfile, artifact hash, or explicitly approved package index. The package name is consistent with the Skill's stated purpose and is not an apparent typosquatting attempt. Nevertheless, the command resolves mutable package and transitive-dependency versions from whichever index is configured in the execution environment.

An attacker who compromises a future package release, a transitive dependency, or the configured Python package index could cause a malicious artifact to be selected. Malicious build logic may execute during installation where source distributions or build backends are involved. Installed pytest plugins may also execute code when pytest discovers and automatically loads them.

Attack Path

1. An attacker compromises a release, transitive dependency, or package source used to resolve pytest-asyncio.
2. A user or agent follows the documentation and runs pip install pytest-asyncio.
3. Pip resolves the attacker-controlled artifact because no approved version or hash is enforced.
4. Malicious code executes during package building or later when pytest imports and automatically loads installed plugins.
5. The code operates with the permissions of the account running pip or pytest.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the invoking user. This may expose source code, test credentials, environment variables, accessible files, and network resources. It could also modify the active Python environment or project files. The command does not request elevated privileges, so the direct privile ...[truncated 89 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pytest-asyncio and all transitive dependencies to reviewed versions.
• Store testing dependencies in a lockfile or requirements file containing cryptographic hashes.
• Install packages only from an approved, explicitly configured package index.
• Prefer isolated, nonprivileged virtual environments or containers for test dependencies.
• Review updates before regenerating dependency locks.
• Use a hash-enforced installation command, for example:

  bash

  python -m pip install --require-hashes -r requirements-test.txt
  

T08 · Insecure Dependencies

Warning

• Location: references/coverage.md:5

Finding

Unpinned pytest-cov Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/coverage.md:5-7
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

pip install pytest-cov

Technical Analysis

The documented installation command does not constrain the version of pytest-cov, verify artifact hashes, use a dependency lockfile, or identify an approved package source. Consequently, installation results can change over time and depend on the package indexes configured in the local environment.

Although pytest-cov is a legitimate package matching the declared coverage-testing functionality, an attacker who gains control of a release, dependency, or configured index could supply malicious content. Build-system code may run during installation for applicable distributions, while pytest plugin discovery can import installed plugin code automatically when tests are subsequently executed.

Attack Path

1. An attacker compromises a package release, transitive dependency, or Python package index involved in dependency resolution.
2. A user or agent executes pip install pytest-cov as documented.
3. Pip selects the malicious artifact because the command does not enforce a reviewed version and hash.
4. The payload executes during a package build or when pytest loads the installed coverage plugin.
5. The payload gains access to resources available to the invoking account.

Impact Assessment

Exploitation may result in arbitrary code execution under the user running package installation or pytest. Accessible test secrets, environment variables, repositories, reports, local files, and network services may be read or modified. The instruction does not itself elevate privileges; impact is bounded by the privileges and environment in which the command is executed.

Remediation

View remediation

Remediation Suggestions

• Define a reviewed, exact pytest-cov version rather than resolving the latest available release.
• Lock and hash all direct and transitive testing dependencies.
• Configure pip to use only an organization-approved package index.
• Perform installation in an isolated virtual environment or disposable container under a nonprivileged account.
• Review dependency changes and provenance before updating the lockfile.
• Use hash verification during installation:

  bash

  python -m pip install --require-hashes -r requirements-test.txt
  

T08 · Insecure Dependencies

Warning

• Location: references/mocking.md:71

Finding

Unpinned pytest-mock Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/mocking.md:71
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Code Snippet:

python

# pip install pytest-mock

Technical Analysis

The commented example recommends installing pytest-mock without a version pin, lockfile, cryptographic hash, or approved index configuration. If a user or agent follows this instruction, pip will select mutable package and transitive-dependency versions according to the environment's current index configuration.

The dependency name is appropriate for the Skill and does not appear intentionally deceptive. The residual supply-chain risk arises from unconstrained resolution: compromise of a package release, dependency, or package source could deliver attacker-controlled code. Such code may execute through package build behavior or pytest's plugin loading mechanism after installation.

Attack Path

1. An attacker obtains control of an eligible package artifact, dependency, release, or configured package source.
2. A user or agent copies and runs the suggested pip install pytest-mock command.
3. Pip resolves the attacker-controlled artifact because no trusted version and hash are required.
4. Malicious logic executes during package building or when pytest discovers and imports the installed plugin.
5. The attacker-controlled process can act with the invoking user's permissions.

Impact Assessment

A successful supply-chain compromise could lead to arbitrary code execution in the testing environment. The payload could access repository contents, test data, environment variables, credentials available to tests, local files, and reachable services. It could also alter project or environment files. No privilege escalation is directly instructed, so the obtainable privileges are those of the account running pip or pytest.

Remediation

View remediation

Remediation Suggestions

• Replace the free-form command with an exact, reviewed dependency specification.
• Maintain direct and transitive testing dependencies in a lockfile with cryptographic hashes.
• Require an approved package index and disable unintended extra indexes.
• Install dependencies in an isolated, nonprivileged environment.
• Audit dependency provenance and changes before accepting upgrades.
• Recommend hash-enforced installation, such as:

  bash

  python -m pip install --require-hashes -r requirements-test.txt
  

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Docker Socket Access

High

• Category: Privilege Escalation
• Confidence: 85% confidence

Finding

Potential security issue detected. Manual review is recommended.

Content

Scanner excerpt · references/fixtures.md (reported line 53)May include surrounding context.

@pytest.fixture(scope="session") def docker_client(): client = DockerClient() yield client client.close()

text

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents its instructional content and headings in Chinese, including section titles and explanatory comments, without indicating that the user can choose another language. The policy requires flagging language or locale constraints when a specific language is effectively forced without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and introductory content are written in Chinese, which imposes a specific language on users without any stated opt-in or alternative. Under the policy, language constraints should either be optional or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This markdown file presents all instructional content in Chinese and does not indicate that the language is optional, selectable, or required for a specific regional/compliance reason. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents all instructional content in a single language and does not indicate that Chinese is optional or that the skill is intended only for a Chinese-speaking audience. Under the policy rule for natural-language violations, forcing a specific language without user opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This markdown file contains user-facing instructional content only in Chinese, beginning with the title and continuing throughout the examples. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.