T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:4- Finding
Overbroad Agent Tool Permissions Violate Least Privilege
- Content
View full analysis
- Remediation
View remediation
Security audit
Cross Disciplinary Bridge Finder
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned, but it requests broad command and file-editing authority and has loose dependency manifests that users should review before installing.
Install only if you are comfortable granting this skill broad local tool access in your agent host. Prefer running it in a sandbox or after the publisher narrows allowed tools, pins dependencies, removes unused packages, and fixes the documented commands.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unpinned, Inconsistent, and Unnecessary Third-Party Dependencies
- Content
View full analysis
=2.8 numpy>=1.21 pandas>=1.3 scikit-learn>=1.0 matplotlib>=3.5 seaborn>=0.11 openai>=1.0 ``` ### Technical Analysis The project has two inconsistent dependency manifests. The root manifest specifies packages without versions, while the script-level manifest uses only minimum-version constraints. Neither manifest provides exact versions, integrity hashes, or a lockfile. As a result, the packages installed can change over time without any source change or security review. The manifests also disagree on `sklearn` versus the canonical `scikit-learn` distribution name. Using an ambiguous or noncanonical package name unnecessarily increases package-index confusion risk. The script-level manifest additionally installs packages that are not used by the audited implementation, including `pandas`, `matplotlib`, `seaborn`, and `openai`. Every unnecessary package increases the number of installation scripts and transitive components that must be trusted. In the audited Python file, NumPy and `sklearn.metrics.pairwise.cosine_similarity` are imported but not used, further indicating that the declared dependency surface can be reduced. No dependency was proven malicious from the available static source. The vulnerability is the non-reproducible and unnecessarily broad supply-chain configuration. ### Attack Path A conditional supply-chain exploitation path is: 1. A user or automated deployment runs `pip install -r requirements.txt` or installs from `scripts/requirements.txt`. 2. The resolver queries the configured package index and selects versions satisfying the unpinned or lower-bounded constraints. 3. A newly released ...[truncated 1239 chars]- Remediation
View remediation
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (18)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest description lists broad phrases such as 'identifying collaboration opportunities across fields' and 'finding experts in complementary disciplines' without explicit trigger boundaries or exclusion conditions. In a skill-selection system, this could cause the skill to be invoked for common high-level research help requests beyond its intended scope.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The bullets describe general tasks like 'finding experts' and 'building interdisciplinary research teams' but do not distinguish this skill from ordinary collaboration or literature-support requests. Without narrower scope or negative examples, these broad triggers increase the chance of unintended activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The summary 'Use when working with cross disciplinary bridge finder' is so generic that it provides little constraint on when the skill should activate. Overly broad activation text can cause the agent to invoke the skill in unrelated contexts, increasing the chance of unnecessary exposure to the skill's instructions or outputs, though this file alone does not show direct malicious behavior.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency is unpinned, so installs may resolve to different versions over time. This weakens reproducibility and can inadvertently pull in a vulnerable or incompatible release through normal package resolution or supply-chain compromise.
- Content
text dataclasses networkx numpy sklearn
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The networkx dependency is not version-pinned, which allows unpredictable package resolution during installation. That increases supply-chain risk and makes it harder to ensure the deployed environment avoids known-vulnerable releases.
- Content
text dataclasses networkx numpy sklearn
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
An unpinned numpy dependency is more concerning because multiple advisories exist for some numpy releases, and without a version constraint there is no assurance that a safe version will be installed. This creates avoidable exposure to known defects as well as general supply-chain drift.
- Content
text dataclasses networkx numpy sklearn
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The manifest includes numpy without a version pin even though some numpy versions have known advisories. Because the installed version cannot be verified from this file, the environment may resolve to an affected release, leaving a known-risk dependency path unaddressed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The sklearn requirement is unpinned, so installation may pull different versions over time. Besides supply-chain unpredictability, this name is also commonly better specified as the actual PyPI package scikit-learn, making explicit version control especially important.
- Content
text dataclasses networkx numpy sklearn
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The dependency is specified with a lower-bound only, so builds may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking upstream releases into the environment.
- Content
text networkx>=2.8 numpy>=1.21 pandas>=1.3 scikit-learn>=1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
Using an unpinned numpy version means the installed package may vary across environments and time, making it impossible to reliably determine exposure to known advisories. In practice this creates supply-chain and patch-management risk because a future resolver run could pull an affected release.
- Content
text networkx>=2.8 numpy>=1.21 pandas>=1.3 scikit-learn>=1.0 matplotlib>=3.5
Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Because numpy is not pinned, the manifest does not establish whether the deployed version is affected by any known advisory. This uncertainty is a real dependency-management weakness: the environment could resolve to a vulnerable release without visibility or reproducibility.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
An unpinned pandas dependency allows uncontrolled version drift. That can lead to installation of vulnerable or incompatible releases and prevents reliable auditing of what code is actually deployed.
- Content
text networkx>=2.8 numpy>=1.21 pandas>=1.3 scikit-learn>=1.0 matplotlib>=3.5 seaborn>=0.11
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The pandas entry is not version-pinned, so known advisory exposure cannot be confirmed or ruled out from the manifest alone. That makes vulnerability assessment unreliable and can leave affected versions in use unnoticed.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The scikit-learn package is not pinned, so dependency resolution can select different versions over time. Because this package has had prior security advisories, leaving it floating increases uncertainty and exposure to vulnerable releases.
- Content
text networkx>=2.8 numpy>=1.21 pandas>=1.3 scikit-learn>=1.0 matplotlib>=3.5 seaborn>=0.11 openai>=1.0
Unverifiable Dependency: scikit-learn has 6 known advisory(ies) (CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
scikit-learn has known advisories, but the unpinned requirement prevents determining whether the installed version is safe. In a data-science-oriented skill, this is still mainly a supply-chain hygiene issue rather than evidence of direct exploitation, but it can become more serious if unsafe deserialization or model loading features are used elsewhere.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
A lower-bound-only matplotlib requirement does not ensure consistent or audited builds. This can result in accidental adoption of problematic upstream versions and makes incident response harder.
- Content
text numpy>=1.21 pandas>=1.3 scikit-learn>=1.0 matplotlib>=3.5 seaborn>=0.11 openai>=1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The seaborn dependency is unpinned, which introduces nondeterminism into installations. While not an immediate exploit by itself, it increases supply-chain risk and complicates vulnerability verification.
- Content
text pandas>=1.3 scikit-learn>=1.0 matplotlib>=3.5 seaborn>=0.11 openai>=1.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The openai package is also unpinned, allowing unexpected upstream changes to enter future installs. For a package that may handle API interactions, uncontrolled upgrades can affect both security posture and operational behavior.
- Content
text scikit-learn>=1.0 matplotlib>=3.5 seaborn>=0.11 openai>=1.0