Cross Disciplinary Bridge Finder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:37 AM UTC
• Version: 0.1.0

Overview

The skill appears purpose-aligned, but it requests broad command and file-editing authority and has loose dependency manifests that users should review before installing.

Install only if you are comfortable granting this skill broad local tool access in your agent host. Prefer running it in a sandbox or after the publisher narrows allowed tools, pins dependencies, removes unused packages, and fixes the documented commands.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:4
• Finding: Overbroad Agent Tool Permissions Violate Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:1-5` **Vulnerability Type**: Excessive agent capabilities **Risk Level**: Medium ### Vulnerable Code ```yaml --- name: cross-disciplinary-bridge-finder description: Use when identifying collaboration opportunities across fields, finding experts in complementary disciplines, translating methodologies between scientific domains, or building interdisciplinary research teams. Identifies synergies between scientific disciplines, matches researchers with complementary expertise, and facilitates cross-domain collaborations. Supports interdisciplinary grant applications and innovative research team formation. allowed-tools: "Read Write Bash Edit" license: MIT ``` ### Technical Analysis The skill requests unrestricted `Read`, `Write`, `Bash`, and `Edit` capabilities. The implemented functionality is an offline knowledge-graph analysis CLI that generates output and optionally writes it to a user-selected file. It does not require general-purpose source editing or unrestricted shell and filesystem access. Granting capabilities beyond those necessary for the task violates the principle of least privilege. In an agent environment, `Bash` may permit arbitrary process execution with the operating-system privileges of the agent, while `Read`, `Write`, and `Edit` may expose or modify files outside the skill directory if the host does not enforce additional sandboxing. No malicious instruction in the audited package currently attempts to abuse these permissions. The risk arises because the broad permission declaration unnecessarily expands the effect of any future compromised skill content, injected contextual instruction, or downstream agent-control failure. ### Attack Path A conditional exploitation path is: 1. A user activates the skill, making the declared tools available to the agent. 2. Attacker-controlled content is introduced through conversation context, external task data, or a future modificati ...[truncated 1027 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `Edit` because the skill does not need to modify source files. 2. Remove unrestricted `Read` if all required data is embedded in the executable. 3. Replace general-purpose `Bash` with a narrowly scoped execution capability that can invoke only `scripts/main.py`. 4. Restrict output writes to an explicit, user-approved output directory. 5. Require confirmation before overwriting an existing file. 6. Enforce host-level command allowlisting, path canonicalization, filesystem sandboxing, and network isolation rather than relying solely on prompt instructions. 7. If the platform supports granular declarations, use a minimal configuration equivalent to: - Execute the designated CLI only. - Write newly generated reports only. - Deny arbitrary source edits and unrelated file access. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1
• Finding: Unpinned, Inconsistent, and Unnecessary Third-Party Dependencies<![CDATA[ ## Vulnerability Details **File Location**: `requirements.txt:1-4` and `scripts/requirements.txt:1-7` **Vulnerability Type**: Unsafe dependency and supply-chain configuration **Risk Level**: Medium ### Vulnerable Code `requirements.txt:1-4`: ```text dataclasses networkx numpy sklearn ``` `scripts/requirements.txt:1-7`: ```text networkx>=2.8 numpy>=1.21 pandas>=1.3 scikit-learn>=1.0 matplotlib>=3.5 seaborn>=0.11 openai>=1.0 ``` ### Technical Analysis The project has two inconsistent dependency manifests. The root manifest specifies packages without versions, while the script-level manifest uses only minimum-version constraints. Neither manifest provides exact versions, integrity hashes, or a lockfile. As a result, the packages installed can change over time without any source change or security review. The manifests also disagree on `sklearn` versus the canonical `scikit-learn` distribution name. Using an ambiguous or noncanonical package name unnecessarily increases package-index confusion risk. The script-level manifest additionally installs packages that are not used by the audited implementation, including `pandas`, `matplotlib`, `seaborn`, and `openai`. Every unnecessary package increases the number of installation scripts and transitive components that must be trusted. In the audited Python file, NumPy and `sklearn.metrics.pairwise.cosine_similarity` are imported but not used, further indicating that the declared dependency surface can be reduced. No dependency was proven malicious from the available static source. The vulnerability is the non-reproducible and unnecessarily broad supply-chain configuration. ### Attack Path A conditional supply-chain exploitation path is: 1. A user or automated deployment runs `pip install -r requirements.txt` or installs from `scripts/requirements.txt`. 2. The resolver queries the configured package index and selects versions satisfying the unpinned or lower-bounded constraints. 3. A newly released ...[truncated 1239 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Establish one authoritative dependency manifest and remove the conflicting duplicate. 2. Remove dependencies that are not required by `scripts/main.py`, particularly `openai`, `pandas`, `matplotlib`, and `seaborn` unless corresponding reviewed functionality is added. 3. Remove the unused NumPy and scikit-learn imports and dependencies if they are not needed. 4. If scikit-learn is retained, use only its canonical distribution name, `scikit-learn`; do not specify `sklearn`. 5. Pin every direct and transitive dependency to an exact reviewed version. 6. Generate a lockfile with cryptographic hashes, such as a hash-locked requirements file produced through `pip-tools`. 7. Install with hash enforcement, for example using `pip install --require-hashes`. 8. Run dependency vulnerability and license scanning in CI. 9. Review dependency updates explicitly rather than accepting any future version satisfying a lower bound. 10. Prefer isolated virtual environments and avoid installing project dependencies with administrative privileges. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The manifest description lists broad phrases such as 'identifying collaboration opportunities across fields' and 'finding experts in complementary disciplines' without explicit trigger boundaries or exclusion conditions. In a skill-selection system, this could cause the skill to be invoked for common high-level research help requests beyond its intended scope.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The bullets describe general tasks like 'finding experts' and 'building interdisciplinary research teams' but do not distinguish this skill from ordinary collaboration or literature-support requests. Without narrower scope or negative examples, these broad triggers increase the chance of unintended activation.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The summary 'Use when working with cross disciplinary bridge finder' is so generic that it provides little constraint on when the skill should activate. Overly broad activation text can cause the agent to invoke the skill in unrelated contexts, increasing the chance of unnecessary exposure to the skill's instructions or outputs, though this file alone does not show direct malicious behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dataclasses
networkx
numpy
sklearn

• Confidence: 97% confidence
• Finding: The dependency is unpinned, so installs may resolve to different versions over time. This weakens reproducibility and can inadvertently pull in a vulnerable or incompatible release through normal package resolution or supply-chain compromise.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dataclasses
networkx
numpy
sklearn

• Confidence: 98% confidence
• Finding: The networkx dependency is not version-pinned, which allows unpredictable package resolution during installation. That increases supply-chain risk and makes it harder to ensure the deployed environment avoids known-vulnerable releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dataclasses
networkx
numpy
sklearn

• Confidence: 99% confidence
• Finding: An unpinned numpy dependency is more concerning because multiple advisories exist for some numpy releases, and without a version constraint there is no assurance that a safe version will be installed. This creates avoidable exposure to known defects as well as general supply-chain drift.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The manifest includes numpy without a version pin even though some numpy versions have known advisories. Because the installed version cannot be verified from this file, the environment may resolve to an affected release, leaving a known-risk dependency path unaddressed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

dataclasses
networkx
numpy
sklearn

• Confidence: 96% confidence
• Finding: The sklearn requirement is unpinned, so installation may pull different versions over time. Besides supply-chain unpredictability, this name is also commonly better specified as the actual PyPI package scikit-learn, making explicit version control especially important.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

networkx>=2.8
numpy>=1.21
pandas>=1.3
scikit-learn>=1.0

• Confidence: 93% confidence
• Finding: The dependency is specified with a lower-bound only, so builds may resolve to different versions over time. This weakens reproducibility and can unintentionally introduce vulnerable or breaking upstream releases into the environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

networkx>=2.8
numpy>=1.21
pandas>=1.3
scikit-learn>=1.0
matplotlib>=3.5

• Confidence: 96% confidence
• Finding: Using an unpinned numpy version means the installed package may vary across environments and time, making it impossible to reliably determine exposure to known advisories. In practice this creates supply-chain and patch-management risk because a future resolver run could pull an affected release.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: Because numpy is not pinned, the manifest does not establish whether the deployed version is affected by any known advisory. This uncertainty is a real dependency-management weakness: the environment could resolve to a vulnerable release without visibility or reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

networkx>=2.8
numpy>=1.21
pandas>=1.3
scikit-learn>=1.0
matplotlib>=3.5
seaborn>=0.11

• Confidence: 93% confidence
• Finding: An unpinned pandas dependency allows uncontrolled version drift. That can lead to installation of vulnerable or incompatible releases and prevents reliable auditing of what code is actually deployed.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The pandas entry is not version-pinned, so known advisory exposure cannot be confirmed or ruled out from the manifest alone. That makes vulnerability assessment unreliable and can leave affected versions in use unnoticed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

networkx>=2.8
numpy>=1.21
pandas>=1.3
scikit-learn>=1.0
matplotlib>=3.5
seaborn>=0.11
openai>=1.0

• Confidence: 95% confidence
• Finding: The scikit-learn package is not pinned, so dependency resolution can select different versions over time. Because this package has had prior security advisories, leaving it floating increases uncertainty and exposure to vulnerable releases.

Unverifiable Dependency: scikit-learn has 6 known advisory(ies) (CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: scikit-learn has known advisories, but the unpinned requirement prevents determining whether the installed version is safe. In a data-science-oriented skill, this is still mainly a supply-chain hygiene issue rather than evidence of direct exploitation, but it can become more serious if unsafe deserialization or model loading features are used elsewhere.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.21
pandas>=1.3
scikit-learn>=1.0
matplotlib>=3.5
seaborn>=0.11
openai>=1.0

• Confidence: 91% confidence
• Finding: A lower-bound-only matplotlib requirement does not ensure consistent or audited builds. This can result in accidental adoption of problematic upstream versions and makes incident response harder.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=1.3
scikit-learn>=1.0
matplotlib>=3.5
seaborn>=0.11
openai>=1.0

• Confidence: 91% confidence
• Finding: The seaborn dependency is unpinned, which introduces nondeterminism into installations. While not an immediate exploit by itself, it increases supply-chain risk and complicates vulnerability verification.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

scikit-learn>=1.0
matplotlib>=3.5
seaborn>=0.11
openai>=1.0

• Confidence: 94% confidence
• Finding: The openai package is also unpinned, allowing unexpected upstream changes to enter future installs. For a package that may handle API interactions, uncontrolled upgrades can affect both security posture and operational behavior.

Static analysis

No suspicious patterns detected.