Forest Plot Styler

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:44 AM UTC
• Version: 0.1.0

Overview

This skill is a local forest-plot generator whose file access and plotting behavior match its stated purpose, with only routine dependency hygiene concerns.

Install and run this in a virtual environment or sandbox, preferably after pinning and auditing the dependencies. Use trusted input files and choose output paths deliberately, since the script will read and write paths provided on the command line.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-3
Related Installation Instruction: SKILL.md:203-205
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-3:

text

matplotlib
numpy
pandas

SKILL.md:203-205:

bash

# Python dependencies
pip install -r requirements.txt

Technical Analysis

The project declares third-party packages without exact version constraints or cryptographic hashes. Consequently, every installation may resolve to different package releases that were not reviewed as part of this audit.

Although the listed package names appear legitimate and there is no direct evidence that they are currently malicious, the dependency installation process lacks reproducibility and integrity enforcement. If an upstream package, release artifact, package index, or dependency account were compromised, the documented installation command could retrieve and install attacker-controlled code.

Attack Path

1. An attacker compromises a declared package, one of its transitive dependencies, its release process, or the package index used by the victim.
2. The attacker publishes or substitutes a malicious release that satisfies the unconstrained dependency declaration.
3. A user follows the installation instruction in SKILL.md and runs pip install -r requirements.txt.
4. Pip resolves and installs the malicious or compromised release because no reviewed version or artifact hash is enforced.
5. Malicious package code can execute during installation or when imported by scripts/main.py:11-14.
6. That code executes with the privileges of the user or automation account running the installation or plotting script.

Impact Assessment

Successful exploitation could provide arbitrary code execution within the installing user's security context. Depending on that account's permissions, the attacker could access project files, input datasets, generated outputs, e ...[truncated 357 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an exact, reviewed version rather than leaving versions unconstrained.
2. Generate a lock file that includes all transitive dependencies.
3. Record cryptographic hashes for approved distribution artifacts and install them with:

bash

pip install --require-hashes -r requirements.txt

4. Obtain packages only from an explicitly configured, trusted package index.
5. Perform dependency vulnerability and provenance checks as part of CI before approving updates.
6. Apply dependency upgrades through a reviewed process instead of resolving arbitrary current releases during deployment.
7. Install dependencies and run the script in a least-privileged virtual environment or sandbox.
8. Reconcile the documentation with the dependency manifest: SKILL.md:158 states that openpyxl is required for Excel support, but it is absent from requirements.txt.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The user-facing CLI help, descriptions, and examples are written in Chinese, while the file does not offer any language choice or indicate that the tool is intentionally region-specific. This can violate language/locale policy when a skill imposes one language on users without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency list uses an unpinned package name for matplotlib, which makes builds non-reproducible and allows different environments to resolve to different versions over time. That can introduce supply-chain risk, unexpected breakage, or accidental installation of a vulnerable release if the resolver selects an unsafe version.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

matplotlib
numpy
pandas

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The numpy dependency is unpinned, so installations are not deterministic and may resolve to versions with known defects or security issues depending on time and environment. In a package used for data analysis and plotting, this primarily creates supply-chain and maintenance risk rather than direct code-execution by itself.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

matplotlib
numpy
pandas

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Numpy has known advisories, and because no version is pinned, there is no way to determine from this manifest whether the installed release is affected. The danger here is uncertainty: a downstream installation could pull a vulnerable version, especially in older or loosely managed environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The pandas dependency is also unpinned, which means the installed version can drift and may unexpectedly include vulnerable or incompatible releases. This weakens reproducibility and makes it harder to verify that deployments are using audited versions.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

matplotlib
numpy
pandas

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Pandas has at least one known advisory, and the lack of version pinning makes it impossible to confirm whether the environment will install a safe release. In this skill's plotting/data-processing context, risk is somewhat limited because requirements.txt alone does not prove unsafe runtime behavior, but it still represents a real supply-chain exposure.

Content

No source excerpt is available for this finding.