Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
dataclasses networkx numpy sklearn
- Confidence
- 92% confidence
- Finding
- networkx
Security audit
Cross Disciplinary Bridge Finder
Security checks across malware telemetry and agentic risk
Overview
This appears to be a local research-helper skill with dependency and packaging hygiene issues, but no evidence of hidden data access, exfiltration, persistence, or destructive behavior.
Install this in an isolated environment, review or pin the dependencies before use, and expect some examples in the documentation to fail because they reference files or APIs not present in the package. Approve Bash and file-write actions explicitly.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
dataclasses networkx numpy sklearn
- Confidence
- 98% confidence
- Finding
- numpy
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
dataclasses networkx numpy sklearn
- Confidence
- 90% confidence
- Finding
- sklearn
Known Vulnerable Dependency: numpy — 10 advisory(ies): CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +7 more
Critical
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
- numpy
VirusTotal
61/61 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.