Biotech Pitch Deck Narrative

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 5:12 AM UTC
• Version: 0.1.0

Overview

This skill is a local biotech pitch-deck writing aid with minor packaging and quality issues, but no evidence of hidden, destructive, or data-exfiltrating behavior.

Before installing, consider removing the two requirements.txt entries or installing in an isolated environment. Do not feed confidential biotech, fundraising, or non-public company information unless you are comfortable with the local agent and workspace handling that data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary and Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–2
Vulnerability Type: Unnecessary unpinned dependencies and avoidable supply-chain exposure
Risk Level: Medium

Complete Code Snippet:

text

dataclasses
enum

Technical Analysis

The project declares dataclasses and enum as external dependencies without exact version constraints or cryptographic hashes. The project documentation requires Python 3.7 or later, where both dataclasses and enum are already available from the Python standard library.

Consequently, these package-index dependencies are unnecessary. Installing them causes a package manager to resolve mutable third-party distributions whose contents are not controlled by this repository. Because neither versions nor hashes are specified, a later installation may retrieve different artifacts from those reviewed during this audit.

This finding does not establish that the currently published packages are malicious. It identifies an avoidable supply-chain trust boundary that could become exploitable if a package release, package-index account, mirror, or dependency-resolution source were compromised.

Attack Path

1. A user or automated deployment process executes pip install -r requirements.txt.
2. The package manager queries its configured package index or mirror for dataclasses and enum.
3. Because no versions or hashes are pinned, the resolver accepts matching mutable distributions selected at installation time.
4. If an accepted distribution has been compromised or substituted, attacker-controlled package content enters the Python environment.
5. Malicious package behavior could then run during installation or when the package is imported by this or another process in the same environment.

Impact Assessment

Successful exploitation could execute code with the privileges of the account performing package installation or running the affected Python ...[truncated 379 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both dependency declarations because Python 3.7 and later provide the required modules through the standard library.
2. Delete requirements.txt if the project has no external runtime dependencies, or leave it explicitly empty with a clarifying comment.
3. If third-party dependencies are added later, pin exact versions and use cryptographic hashes, such as with pip install --require-hashes.
4. Generate and review a reproducible lock file through an approved dependency-management workflow.
5. Restrict installations to a trusted package index or internal mirror and incorporate dependency scanning into CI.
6. Install dependencies in an isolated, least-privileged virtual environment or build container.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The markdown states a known issue that the interface help text is in Chinese and plans to translate all interface text to English. This implies the skill currently forces a specific language/locale for at least part of the user experience, without offering a user choice or documenting a region-specific reason.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum