ML Pipeline

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:24 AM UTC
• Version: 0.1.0

Overview

The skill is not clearly malicious, but it materially overstates its trading ML capabilities while shipping local file-scanning and deployment scripts with unsafe overwrite and rollback behavior.

Review this skill carefully before installing. Do not rely on the bundled scripts for trading ML validation, feature engineering, model evaluation, feature importance, or leakage checks unless they are rewritten and tested. If used at all, run scripts only on narrow test directories, avoid sensitive workspaces or home directories, and do not use the deployment utility on important targets without fixing overwrite, rollback, and symlink-containment safeguards.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/pipeline_deployment.py:63

Finding

Deployment Operations Can Escape the Target Directory Through Symbolic Links

Content

View full analysis

Vulnerability Details

File Location: scripts/pipeline_deployment.py, lines 63–71 and 108–116
Vulnerability Type: Unvalidated symbolic-link traversal during deployment and rollback
Risk Level: High

Vulnerable Code

python

for source_file in self.source.rglob('*'):
    if source_file.is_file():
        relative_path = source_file.relative_to(self.source)
        target_file = self.target / relative_path

        try:
            target_file.parent.mkdir(parents=True, exist_ok=True)
            shutil.copy2(source_file, target_file)
            self.deployed.append(str(relative_path))
            print(f"  ✓ Deployed: {relative_path}")

python

for deployed_file in self.deployed:
    file_path = self.target / deployed_file
    if file_path.exists():
        file_path.unlink()
        print(f"  ✓ Removed: {deployed_file}")

# Remove empty directories
for dir_path in sorted(self.target.rglob('*'), reverse=True):
    if dir_path.is_dir() and not any(dir_path.iterdir()):
        dir_path.rmdir()

Technical Analysis

The deployment utility constructs destination paths by joining an unvalidated relative source path to the target directory. It does not resolve the resulting path and verify that it remains under the intended deployment root.

Path.is_file() and shutil.copy2() can follow symbolic links. A symbolic-link file in the source can therefore cause data outside the source directory to be copied. Separately, a pre-existing symbolic-link directory beneath the target can redirect writes outside the intended target directory.

The rollback implementation reconstructs file paths from the same unvalidated relative names and calls unlink(). If an intermediate target component is a symbolic link, rollback can reach and delete a file outside the deployment root.

Attack Path

1. An attacker controls part of the source tree or can prepare the target directory. 2 ...[truncated 1216 chars]

Remediation

View remediation

Remediation Suggestions

• Resolve the source root and target root before processing files.
• Resolve each source and destination path and verify containment using Path.is_relative_to() or an equivalent robust check.
• Reject symbolic links in the source tree and in every target path component.
• Use file operations that do not follow symbolic links where supported.
• Deploy into a newly created directory owned by the invoking account rather than an existing, potentially attacker-controlled directory.
• Before rollback, repeat the containment and symbolic-link checks.
• Avoid relying on string-prefix comparisons for path validation.
• Run deployment under a dedicated, least-privileged account.
• Add automated tests covering source symlinks, target-directory symlinks, nested links, and rollback behavior.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/pipeline_deployment.py:63

Finding

The Advertised Overwrite Protection Is Not Enforced

Content

View full analysis

Vulnerability Details

File Location: scripts/pipeline_deployment.py, lines 63–71 and 120–125
Vulnerability Type: Missing authorization check for destructive overwrite
Risk Level: Medium

Vulnerable Code

python

for source_file in self.source.rglob('*'):
    if source_file.is_file():
        relative_path = source_file.relative_to(self.source)
        target_file = self.target / relative_path

        try:
            target_file.parent.mkdir(parents=True, exist_ok=True)
            shutil.copy2(source_file, target_file)
            self.deployed.append(str(relative_path))

python

parser = argparse.ArgumentParser(description="Script to deploy the trained AutoML pipeline to a production environment.")
parser.add_argument('source', help='Source directory')
parser.add_argument('target', help='Target deployment directory')
parser.add_argument('--dry-run', action='store_true', help='Simulate deployment')
parser.add_argument('--force', action='store_true', help='Overwrite existing files')
parser.add_argument('--rollback-on-error', action='store_true', help='Rollback on any error')

Technical Analysis

The command-line interface suggests that existing files will only be overwritten when --force is supplied. However, args.force is never checked. shutil.copy2() overwrites an existing regular destination file by default.

This creates a discrepancy between the documented safety control and actual behavior. The rollback mechanism does not retain backups of overwritten files; it only records relative names. Consequently, rollback deletes the replacement file rather than restoring the original content.

Attack Path

1. The deployment target contains an existing configuration, model, executable, or other valuable file.
2. A source tree contains a file at the same relative path.
3. A user runs the deployment script without --force, expecting existing files to be preserve ...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

• Check target_file.exists() before every copy.
• Refuse to overwrite existing files unless args.force is explicitly set.
• Pass the force policy into the Deployer object instead of parsing and then ignoring it.
• Create backups of existing files before authorized overwrites.
• Track whether each destination was newly created or replaced.
• During rollback, delete newly created files and restore replaced files from their backups.
• Use atomic staging and rename operations to avoid partially updated deployments.
• Add tests proving that deployment without --force preserves existing files.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/data_validation.py:15

Finding

ML Utilities Are Misrepresented Placeholders That Recursively Access Arbitrary Local Files

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/data_validation.py, lines 15–50
• scripts/data_visualizer.py, lines 15–50
• scripts/feature_engineering_pipeline.py, lines 15–50
• scripts/model_evaluation.py, lines 15–50
• scripts/feature_store_integration.py, lines 15–50
• scripts/feature_importance_analyzer.py, lines 27–48

Vulnerability Type: Excessive filesystem access and material discrepancy between declared and actual behavior
Risk Level: Medium

Vulnerable Code

The following implementation is repeated in five scripts:

python

def process_file(file_path: Path) -> bool:
    """Process individual file."""
    if not file_path.exists():
        print(f"❌ File not found: {file_path}")
        return False

    print(f"📄 Processing: {file_path}")

    # Add processing logic here based on skill requirements
    # This is a template that can be customized

    try:
        if file_path.suffix == '.json':
            with open(file_path) as f:
                data = json.load(f)
            print(f"  ✓ Valid JSON with {len(data)} keys")
        else:
            size = file_path.stat().st_size
            print(f"  ✓ File size: {size:,} bytes")

        return True
    except Exception as e:
        print(f"  ✗ Error: {e}")
        return False

def process_directory(dir_path: Path) -> int:
    """Process all files in directory."""
    processed = 0
    failed = 0

    for file_path in dir_path.rglob('*'):
        if file_path.is_file():
            if process_file(file_path):
                processed += 1
            else:
                failed += 1

    return processed, failed

The feature-importance analyzer similarly traverses the entire supplied directory:

python

def analyze_directory(self) -> Dict:
    """Analyze directory structure and contents."""
    if not self.target_path.exists():
        self.stats['issues']
...[truncated 2957 chars]

Remediation

View remediation

Remediation Suggestions

• Replace each placeholder with a narrowly scoped implementation matching its documented purpose.
• Accept explicit dataset or model paths rather than recursively traversing arbitrary directories.
• Require and validate supported file formats.
• Make recursive traversal opt-in and clearly disclose it.
• Reject filesystem roots, home directories, system directories, and other overly broad inputs unless explicitly authorized.
• Add configurable file-count and file-size limits.
• Stream or size-check JSON input before parsing it.
• Avoid printing complete sensitive paths unless verbose logging is explicitly enabled.
• Ensure successful exit status means the advertised operation was actually completed.
• Update SKILL.md and scripts/README.md so documented behavior accurately reflects implementation status.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/pipeline_deployment.py:84

Finding

Undefined Type Annotation Prevents the Deployment Utility from Starting

Content

View full analysis

Vulnerability Details

File Location: scripts/pipeline_deployment.py, line 84
Vulnerability Type: Undefined annotation causing startup failure
Risk Level: Low

Vulnerable Code

python

def generate_report(self) -> Dict:
    """Generate deployment report."""
    report = {
        "deployment_time": datetime.now().isoformat(),
        "skill": "automl-pipeline-builder",
        "source": str(self.source),
        "target": str(self.target),
        "total_files": len(self.deployed) + len(self.failed),
        "deployed": len(self.deployed),
        "failed": len(self.failed),
        "deployed_files": self.deployed,
        "failed_files": self.failed
    }

The module imports do not define Dict:

python

import os
import json
import shutil
import argparse
from pathlib import Path
from datetime import datetime

Technical Analysis

Dict is used as a return annotation but is not imported from typing. The module also does not enable postponed annotation evaluation with from __future__ import annotations.

In Python versions that evaluate annotations when the function is defined, class creation raises NameError: name 'Dict' is not defined. This occurs before command-line processing or deployment logic can execute.

Attack Path

1. A user invokes the documented deployment script.
2. Python imports the module and begins defining the Deployer class.
3. The interpreter evaluates the Dict return annotation.
4. Because Dict is undefined, a NameError is raised.
5. The deployment process terminates before main() runs.

This is primarily a deterministic availability defect rather than an attacker-dependent exploit.

Impact Assessment

The issue prevents normal use of the deployment utility and can interrupt automated release or deployment workflows. It does not provide unauthorized privileges, code execution, or data access by itself.

Remediation

View remediation

Remediation Suggestions

Use one of the following corrections:

python

from typing import Dict

Alternatively, use the built-in generic type:

python

def generate_report(self) -> dict:

Postponed annotation evaluation can also be enabled:

python

from __future__ import annotations

Add a basic automated test that imports every bundled Python module and invokes each script with --help to detect startup failures.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a broad ML-for-trading pipeline with advanced capabilities. The supplied code chunk only performs very basic filesystem-oriented validation/reporting: existence checks, JSON parsing, file size reporting, directory traversal, and optional config loading. Its primary purpose is generic input file validation, not building or running a trading ML pipeline. There is no evidence of feature creation, training, hyperparameter search, leakage checks, market data handling, or any financial/ML execution. Therefore the description materially overstates and misrepresents the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a broad automated trading ML pipeline with advanced modeling and validation capabilities. The supplied code does none of that. Its actual behavior is limited to command-line file/directory processing: checking file existence, printing file sizes, loading JSON files, walking directories, and summarizing counts. Even the module/docstring claim about generating feature visualizations is not implemented. This is a clear description-behavior mismatch because the primary purpose is materially different and the advertised ML/trading capabilities are absent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description substantially overstates the code’s behavior. The script is essentially a template/utility for traversing files and directories, reporting file size, and validating/loading JSON. Its own processing logic is explicitly left as a placeholder ('Add processing logic here based on skill requirements'). There is no evidence of data cleaning, transformation, feature selection, model training, hyperparameter sweeps, trading workflows, deep learning, reinforcement learning, or anti-leakage validation. The primary purpose of the actual code is generic file processing, which is materially different from the declared ML/trading pipeline.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. Although the docstring and CLI description claim feature-importance analysis, the implemented code only walks a directory tree and summarizes filesystem metadata such as file counts, extensions, sizes, empty files, and large files. Compared with the declared purpose, the primary purpose is materially different: system/file analysis rather than a trading ML pipeline. It also introduces an undeclared capability—recursive filesystem scanning and report generation—that is unrelated to the declared trading/ML functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises a broad, trading-oriented ML pipeline with advanced capabilities such as feature engineering, AutoML, deep learning, financial RL, parameter sweeps, model training, and anti-leakage validation. The supplied code does none of that. Its actual behavior is limited to traversing files/directories, checking existence, parsing JSON files to report key counts, reporting file sizes for other files, and optionally loading a JSON config. This is a generic scaffold/template rather than an implemented ML pipeline or feature-store integration tool. The mismatch is material because the primary purpose and capabilities described are absent from the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a substantial ML-for-trading pipeline with model development, validation, and evaluation capabilities. The supplied code does not implement any of those functions. Instead, it is a generic scaffold that accepts a file or directory, traverses files, validates/parses JSON superficially, reports file sizes, and prints summary output. While the module docstring mentions model evaluation, the implemented behavior does not compute metrics, load trained models, generate evaluation reports, or perform any trading-specific or ML-specific operations. This is a clear material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code does not implement any machine learning pipeline behavior such as feature engineering, model training, AutoML, deep learning, reinforcement learning, parameter sweeps, or validation. Its primary purpose is operational deployment: copying files from a source directory to a target directory, generating deployment metadata/report files, and rolling back deployed files if needed. This is materially different from the declared trading ML pipeline purpose, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script advertises ML feature-importance analysis but only performs recursive filesystem inventory, size checks, and report generation. In an automated ML pipeline, this mismatch can mislead operators or downstream agents into trusting nonexistent model-insight or validation functionality, causing unsafe decisions, skipped review, or misuse of the tool against unintended directories.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The CLI help text repeats the false claim that the tool analyzes feature importance, while execution actually traverses arbitrary directories and writes generic reports. This active contradiction increases the risk of operator deception in pipeline automation, especially in a trading/ML skill where users may rely on the tool for anti-leakage or model-governance tasks that it does not perform.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The docstrings and comments describe a specialized model-evaluation component, but the code is only a generic file-processing template. This can mislead operators, auditors, or automated agents into believing critical model-assurance checks exist when they do not, which is especially risky in a financial trading ML context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script advertises AutoML model evaluation and report generation, but it only checks whether inputs are valid JSON or prints file sizes. In an ML trading pipeline, this mismatch is dangerous because downstream users may rely on nonexistent validation, performance scoring, or anti-leakage checks and make deployment decisions based on false assumptions.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/pipeline_deployment.py (reported line 124)May include surrounding context.

python

parser.add_argument('source', help='Source directory')
    parser.add_argument('target', help='Target deployment directory')
    parser.add_argument('--dry-run', action='store_true', help='Simulate deployment')
    parser.add_argument('--force', action='store_true', help='Overwrite existing files')
    parser.add_argument('--rollback-on-error', action='store_true', help='Rollback on any error')

    args = parser.parse_args()

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script presents itself as performing data validation for an AutoML pipeline, but it only checks file existence, file size, and whether JSON parses. In an ML/trading pipeline, this can create a false sense of safety and allow malformed, schema-incompatible, stale, poisoned, or leakage-inducing datasets to pass downstream into training or evaluation, undermining model integrity and potentially financial decision-making.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level docstring says the script generates visualizations of features and their relationship to the target variable, but the inline comments explicitly state that processing logic still needs to be added and that the file is a customizable template. That is a direct contradiction between the documented intent and the actual implementation state.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Both the module docstring and CLI description present this script as a data visualization tool for feature engineering, which would imply plotting or analysis of feature-target relationships. In reality, the code only traverses files, validates JSON, and reports basic metadata, with no visualization or ML-related processing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring and CLI description state that the tool handles data loading, cleaning, transformation, selection, and model training. In reality, the implemented logic only checks whether files exist, loads JSON files, reports key counts, and prints file sizes; no ML pipeline, feature engineering, or training behavior is present.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring and CLI description state that this script integrates with feature stores such as Feast or Tecton to manage and serve features. In reality, the implementation only walks local files/directories, reads JSON, and reports file size, with no feature-store APIs, serving, registry operations, or ML pipeline behavior present.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level docstring says the script integrates with feature stores for online/offline model deployment, implying concrete functionality. However, the inline comments explicitly state that processing logic still needs to be added and that the file is only a template, which contradicts the stated implemented intent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest describes a machine learning pipeline for feature engineering, training, AutoML, deep learning, RL, parameter sweeps, and validation. This script instead prepares target directories, copies arbitrary files into a deployment location, writes deployment metadata/reports, and deletes deployed files during rollback, which is operational deployment behavior rather than model-building or validation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The comments indicate this script contains processing logic tailored to the skill's requirements, yet the surrounding implementation is explicitly a placeholder and does not perform any of the documented feature-engineering or training steps. This creates intent confusion between the documented purpose and actual behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The --dry-run option is documented as 'Simulate deployment', which implies the script will exercise deployment logic without making changes. In practice, the code immediately prints a message and returns before even validating the source or determining what would be deployed, so the documentation overstates what the flag does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.