T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unnecessary Unpinned Third-Party Dependencies Create Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Figure Legend Gen
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate figure-legend helper, but its draft package has under-scoped file-writing and install risks users should review before installing.
Review before installing. Use an isolated virtual environment and a trusted package index, or remove the unnecessary requirements. If you run the skill, keep --output inside your workspace, avoid overwriting existing files, and be cautious with unpublished or sensitive research figures because the documentation is unclear about the claimed network/API behavior.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/main.py:316- Finding
Unrestricted Output Path Allows Overwriting Arbitrary Writable Files
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises file-write capability via the CLI
--outputparameter and broader script execution, but it does not declare any explicit tool scope such as allowed tools or permissions. That mismatch can cause agents or reviewers to underestimate what the skill may do, increasing the chance of unintended file modification or policy bypass when the skill is invoked.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger description is broad enough to activate on many research-related uploads or requests, without clearly constraining when the skill should run or what data classes are safe to process. In a system that may handle sensitive unpublished figures or biomedical imagery, over-broad invocation increases the risk of processing confidential data without sufficient user awareness or review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation explicitly mentions external API calls and file read/write behavior, yet it does not provide a clear user-facing warning about data leaving the local environment or being written to disk. For scientific figures, this can expose unpublished or sensitive research data to external services or create unexpected local artifacts, especially given the skill's broad research context.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example uses
--image.pngas if it were a command-line flag, but the documented interface elsewhere requires--input <image_path>. This documentation contradicts the stated invocation pattern and could cause users or downstream agents to invoke the skill incorrectly.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill supports bar charts, line graphs, scatter plots, box plots, heatmaps, and microscopy images, and generates figure legend text for those figure classes. This template file also provides Flow Cytometry and Western Blot legend templates, which expands the apparent supported figure types beyond the manifest description.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 60% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
text dataclasses enum
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 60% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
text dataclasses enum
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description limits the supported figure types to six categories and does not mention flow cytometry or western blot figures. In contrast, the code explicitly defines ChartType.FLOW and ChartType.WESTERN and provides full templates and CLI support for them, expanding the implemented behavior beyond the stated scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The CLI hard-limits output language choices to "en" and "zh", which imposes a locale constraint in user-facing behavior. The file does not document why only these languages are allowed or offer a broader user opt-in mechanism beyond this fixed list.
- Content
Static analysis
No suspicious patterns detected.