Code Refactor for Reproducibility

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent research-code scaffolder, but it needs review because its dependency file includes an unjustified package and the generated workflow records local machine details.

Review before installing or running. Do not install the packaged requirements until `src` is removed and real versions are pinned. Run the generator only on an intended project directory, choose a new empty output directory, and review generated `reproducibility_info.json` before sharing results because it may contain hostname and package inventory details.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: requirements.txt:1

Finding

Unvetted and Unpinned Third-Party Dependency Named "src"

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-5
Related Location: SKILL.md:217-224
Vulnerability Type: Dependency confusion and unpinned supply-chain dependency
Risk Level: High

Vulnerable Code

text

numpy
pandas
pytest
scipy
src

The documented installation workflow executes:

text

pip install pipreqs
pipreqs src/ --output requirements.txt --force

text

python -m venv .venv_test && source .venv_test/bin/activate
pip install -r requirements.txt
python -c "import pandas, numpy, sklearn"
deactivate && rm -rf .venv_test

Technical Analysis

The root dependency file declares a third-party package named src, despite the audited script not importing a distribution by that name. src is a generic project-layout directory name and should not normally be installed as an external package.

When users follow the documented installation procedure, pip resolves src from the configured package index. An attacker who controls, compromises, or successfully substitutes the corresponding package can supply malicious installation artifacts. Depending on the package format and installer behavior, attacker-controlled code may execute during package building or installation. Malicious runtime code could also execute if the package is subsequently imported.

In addition, every dependency is unpinned and lacks integrity hashes. Resolution can therefore change over time without any repository modification, making the installed environment dependent on the current state of external package indexes.

Attack Path

1. An attacker publishes or compromises a package matching the generic dependency name src, or influences a package index used by the victim.
2. A user or CI worker follows SKILL.md and runs pip install -r requirements.txt.
3. pip resolves and downloads the attacker-controlled or compromised package.
4. Malicious build ...[truncated 867 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove src from requirements.txt unless a specific, reviewed third-party distribution by that exact name is demonstrably required.
2. Pin every direct dependency to a reviewed version, for example:

   text

   numpy==<reviewed-version>
   pandas==<reviewed-version>
   pytest==<reviewed-version>
   scipy==<reviewed-version>
   

3. Generate a lock file with verified transitive dependency versions.
4. Require package hashes by using a hash-locked requirements file and pip install --require-hashes.
5. Configure approved package indexes explicitly and prevent unintended fallback to public indexes in sensitive environments.
6. Install dependencies in an unprivileged, isolated virtual environment or restricted CI container.
7. Add automated dependency scanning and review dependency changes before installation.
8. Correct SKILL.md so its installation and verification commands refer only to declared, reviewed packages.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/main.py:865

Finding

Generated Pipeline Automatically Records Host and Package Inventory

Content

View full analysis

Vulnerability Details

File Location: scripts/main.py:865-895
Invocation Location: scripts/main.py:992
Vulnerability Type: Local environment information disclosure
Risk Level: Medium

Vulnerable Code

The generator embeds the following function in the generated src/utils.py file:

python

def save_reproducibility_info(output_dir: str) -> None:
    """Save system and environment info for reproducibility.
    
    Parameters
    ----------
    output_dir : str
        Directory to save info
    """
    import json
    import platform
    import subprocess
    
    info = {
        'python_version': sys.version,
        'platform': platform.platform(),
        'hostname': platform.node(),
    }
    
    # Try to get package versions
    try:
        result = subprocess.run(
            ['pip', 'freeze'],
            capture_output=True,
            text=True
        )
        info['packages'] = result.stdout.strip().split('\n')
    except Exception:
        info['packages'] = []
    
    output_path = Path(output_dir) / 'reproducibility_info.json'
    with open(output_path, 'w') as f:
        json.dump(info, f, indent=2)
    
    logging.getLogger(__name__).info(f"Saved reproducibility info to {output_path}")

The generated pipeline invokes the function automatically:

python

# Save reproducibility info
save_reproducibility_info(output_dir)

Technical Analysis

Each execution of the generated pipeline automatically collects the host name, operating-system and platform details, full Python version, and the output of pip freeze. It writes this inventory in plaintext to reproducibility_info.json inside the user-selected output directory.

No network transmission was identified in the audited code, and the fixed argument-list subprocess call does not present shell-command injection. The security concern is that the ge ...[truncated 1792 chars]

Remediation

View remediation

Remediation Suggestions

1. Make environment-inventory generation opt-in through a command-line flag such as --save-environment-info.
2. Remove hostname from the default report because it is not necessary for package reproducibility.
3. Document exactly which metadata is collected and where it is written before collection occurs.
4. Generate a minimal dependency manifest containing only approved package names and versions required by the project.
5. Redact editable-install paths, credentials embedded in source URLs, private index addresses, and other local path information.
6. Store sensitive diagnostic inventories outside directories intended for publication, or add the report to .gitignore by default.
7. Warn users to review and sanitize the report before sharing or archiving results.
8. Invoke the package inventory through the active interpreter, such as sys.executable -m pip freeze, check the subprocess return code, and handle failures explicitly. This improves correctness but does not replace the required privacy controls.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The command sequence uses shell chaining and includes a destructive cleanup step (rm -rf .venv_test) after activation/deactivation. Although intended as routine environment cleanup, chained shell snippets normalize multi-step execution with deletion, which can be hazardous if copied, modified, or run from an unexpected directory or shell context.

Content

Scanner excerpt · SKILL.md (reported line 226)May include surrounding context.

python -m venv .venv_test && source .venv_test/bin/activate pip install -r requirements.txt python -c "import pandas, numpy, sklearn" deactivate && rm -rf .venv_test

text

### environment.yml (Conda)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs users to run shell commands, read project files, and potentially modify code, but it does not declare any explicit tool scope such as allowed-tools or permissions. This creates an authorization ambiguity where an agent may infer broader capabilities than intended, increasing the risk of unsafe file or shell operations during activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The top-level description is broad enough to match many ordinary research, coding, and documentation requests, which can cause the skill to activate in contexts beyond its narrowly intended use. Overbroad activation increases the chance that users are steered into executing packaged scripts or making filesystem changes when a simpler or safer skill would suffice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The 'When to Use' section remains ambiguous and lacks negative examples or hard boundaries, so the skill can plausibly attach to a wide range of analysis or coding tasks. In an agentic setting, ambiguous routing is dangerous because it can trigger shell-driven workflows and code modification patterns in situations where they are unnecessary or unsafe.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The top-level docstring states that the tool will refactor messy scripts, implying substantive code transformation. In contrast, the generated analysis module contains TODO placeholders and the CLI summary explicitly tells the user to copy original functions into src/ manually, contradicting the stated behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest and module docstring describe refactoring messy R/Python scripts into modular, reproducible code, but generate_structure only creates boilerplate files, directories, and placeholder modules. The original code is analyzed superficially and its functions are not migrated or rewritten; later output even instructs the user to manually copy original functions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/main.py (reported line 161)May include surrounding context.

python

def generate_structure(self, output_dir: Path, analysis_results: List[Dict]):
        """Generate project structure"""
        # Create directory
        dirs = ['src', 'tests', 'data/raw', 'data/processed', 'results', 'docs', 'notebooks']
        for d in dirs:
            (output_dir / d).mkdir(parents=True, exist_ok=True)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The tool writes many files and directories into a user-chosen output path using create/overwrite behavior without an explicit safety prompt or empty-directory check. In an automated agent setting, this can overwrite existing project artifacts, pollute repositories, or modify unintended locations if the output path is wrong or attacker-influenced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script recursively traverses a user-supplied directory and reads all matching files beneath it, which can unintentionally sweep in sensitive source material or very large directory trees. In the context of an agent skill, broad filesystem enumeration beyond the minimally intended project scope increases the risk of over-collection and exposure of local data.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency list leaves numpy unpinned, so builds are not reproducible and may resolve to different versions over time, including vulnerable or breaking releases. In a reproducibility-focused skill, this is more concerning than usual because deterministic environments are a core requirement and unpinned packages undermine both security review and scientific repeatability.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

numpy
pandas
pytest
scipy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Because numpy is unpinned and has known advisories across some versions, the manifest does not allow verification that installs avoid affected releases. This creates uncertainty in the software supply chain and is especially problematic for a publication/reproducibility skill that should define exact, reviewable environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The pandas requirement is unpinned, which permits installation of arbitrary future or older resolver-selected versions. That weakens supply-chain control and makes published research workflows non-reproducible, increasing the chance of pulling a vulnerable or incompatible release.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

numpy
pandas
pytest
scipy
src

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

pandas has known advisories in some releases, but the unpinned requirement prevents determining whether the environment will install a safe version. That makes security posture unverifiable and undermines repeatable, reviewable builds.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

pytest is listed without a version constraint, so test environments may vary across installations and could resolve to affected releases. Even though it is commonly a development dependency, unpinned test tooling can still introduce supply-chain and reproducibility issues.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

numpy
pandas
pytest
scipy
src

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

The unpinned pytest dependency means the project may resolve to versions with known issues, while preventing reliable verification of the actual installed release. Although test-only exposure may reduce operational risk, it still affects CI integrity and reproducibility.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

scipy is unpinned, allowing non-deterministic dependency resolution and making it impossible to verify whether deployed environments are using safe, tested versions. For a skill explicitly about reproducible scientific workflows, this directly conflicts with the intended security and reliability posture.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

numpy
pandas
pytest
scipy
src

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

scipy has version-specific advisories, and the current manifest does not constrain which release will be installed. As a result, consumers cannot verify whether they are protected from known vulnerable versions, which is a supply-chain and reproducibility weakness.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

pandas
pytest
scipy
src

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/main.py (reported line 294)May include surrounding context.

python

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The generated module docstring claims 'Core analysis functions' and 'All functions include reproducibility guarantees,' but the body only defines generic helper routines and TODO comments instead of real refactored analysis functions. This is an intent/documentation overstatement relative to what the code actually provides.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/main.py (reported line 1163)May include surrounding context.

python

# Install system dependencies
RUN apt-get update && apt-get install -y \\
    git \\
    && rm -rf /var/lib/apt/lists/*

# Copy requirements first for better caching
COPY requirements.txt .

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/main.py (reported line 1163)May include surrounding context.

python

# Install system dependencies
RUN apt-get update && apt-get install -y \\
    git \\
    && rm -rf /var/lib/apt/lists/*

# Copy requirements first for better caching
COPY requirements.txt .

Chaining Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/main.py (reported line 1163)May include surrounding context.

python

# Install system dependencies
RUN apt-get update && apt-get install -y \\
    git \\
    && rm -rf /var/lib/apt/lists/*

# Copy requirements first for better caching
COPY requirements.txt .

Static analysis

No suspicious patterns detected.