Funding Trend Forecaster

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:57 PM UTC
• Version: 0.1.0

Overview

The skill does not show theft or persistence, but it can present synthetic grant forecasts as real analysis and has avoidable install-time supply-chain risk.

Treat this as a demo-quality skill unless the publisher adds real data ingestion and clearly labels synthetic output. Install only in an isolated environment, pin and review dependencies first, and do not rely on generated funding forecasts for decisions without independent verification.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependencies Expand the Supply-Chain Attack Surface

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (19)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill advertises analysis of recent NIH, NSF, and Horizon Europe grant abstracts, but the implemented execution path relies on synthetic mock data rather than real source data. This creates a serious integrity and trust problem: users may make funding, research, or strategic decisions based on fabricated outputs presented as real analysis.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documents file read/write capabilities and a hybrid tool/script design, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent or reviewer cannot easily determine or enforce what filesystem access is intended, increasing the chance of overbroad file operations beyond the expected workspace.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill prominently advertises automatic collection from external sources and report generation, but it does not provide clear user-facing warnings that execution will make network requests and write files locally. This weakens informed consent and can lead users or agents to trigger outbound connectivity and local data creation unexpectedly, which is especially relevant for a high-risk hybrid skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The docstring acknowledges that real deployments should fetch data from APIs, yet the executable path always generates mock data, making the live behavior inconsistent with the stated purpose. This is dangerous because it can mislead operators into believing results reflect current funding landscapes when they are actually derived from synthetic samples.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The configuration hard-codes the NLP language to 'en', which imposes a specific language/locale behavior. The document does not offer a language choice or explain that the tool is intentionally limited to English-only source material, so this is a natural-language policy concern under the locale rule.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency list leaves beautifulsoup4 unpinned, so builds may resolve to different releases over time, including buggy or compromised versions. This weakens supply-chain integrity and makes security review and reproducibility difficult, even though the manifest itself does not prove an actively exploitable issue.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

beautifulsoup4
dateutil
matplotlib
numpy

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

dateutil is unpinned, allowing environment-dependent installation of arbitrary future or outdated versions. This creates a software supply-chain risk and prevents deterministic rebuilds and reliable patch management.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

beautifulsoup4
dateutil
matplotlib
numpy
pandas

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

matplotlib is specified without a version, so installations may pull different releases across environments and time. Unpinned packages increase the chance of introducing vulnerable or incompatible code through routine installs.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

beautifulsoup4
dateutil
matplotlib
numpy
pandas
python-dateutil

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

numpy is unpinned, which is particularly risky because the package has a long vulnerability history and the resolved version is unknown. While this file alone does not confirm exploitation, it leaves consumers exposed to accidental installation of affected releases.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

beautifulsoup4
dateutil
matplotlib
numpy
pandas
python-dateutil
requests

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The manifest does not pin numpy, and numpy has known advisories across multiple versions, so the actual installed release cannot be verified as safe. This uncertainty is itself a security weakness because vulnerable versions may be installed without detection, though the file does not prove a specific CVE is present.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

pandas is unpinned, so deployments may use varying versions with different security and deserialization behaviors. This is a supply-chain hygiene weakness that can enable vulnerable versions to persist unnoticed.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

dateutil
matplotlib
numpy
pandas
python-dateutil
requests
scikit-learn

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Because pandas is unpinned and has a known advisory history, the security posture of the resulting environment cannot be verified from this manifest. In data-processing code, that uncertainty matters because vulnerable parsing or deserialization behaviors may remain reachable.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

python-dateutil is unpinned, which means the installed version can drift over time and across systems. This undermines reproducibility and can silently introduce vulnerable or breaking dependency updates.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

matplotlib
numpy
pandas
python-dateutil
requests
scikit-learn
seaborn

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

requests is unpinned, which is more concerning because it is a network-facing library with multiple historical advisories. In a skill that likely fetches external funding data, an affected resolved version could expose credentials, request integrity, or transport security weaknesses.

Content

Scanner excerpt · requirements.txt (reported line 7)May include surrounding context.

text

numpy
pandas
python-dateutil
requests
scikit-learn
seaborn

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

requests has known advisories and is left unpinned, so installations may resolve to versions with credential leakage or transport-related flaws. Given this skill's likely use of external grant APIs and web resources, that uncertainty increases the practical risk compared with purely local libraries.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

scikit-learn is unpinned, allowing inconsistent versions to be installed, including versions with known security or denial-of-service issues. This is especially relevant in ML workflows where model loading or data processing paths may be sensitive.

Content

Scanner excerpt · requirements.txt (reported line 8)May include surrounding context.

text

pandas
python-dateutil
requests
scikit-learn
seaborn

Unverifiable Dependency: scikit-learn has 6 known advisory(ies) (CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

scikit-learn is unpinned despite known advisories, so the deployed version cannot be verified from this file. In ML tooling, this matters because vulnerable versions may affect model loading, data leakage, or denial-of-service resilience.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

seaborn is unpinned, creating nondeterministic builds and increasing exposure to future vulnerable or malicious releases. Although lower risk than a network or serialization library, it still represents avoidable supply-chain weakness.

Content

Scanner excerpt · requirements.txt (reported line 9)May include surrounding context.

text

python-dateutil
requests
scikit-learn
seaborn

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring describes the skill only in Chinese, and the surrounding inline comments/docstrings are also predominantly Chinese. For a general-purpose skill, this imposes a language choice in the natural-language interface without offering an alternative or explicit user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.