Security audit

Keyword Velocity Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a straightforward local literature-trend analyzer, with dependency hygiene issues to fix before broad deployment.

Install only in an isolated virtual environment, remove the unnecessary dataclasses and enum dependencies for Python 3.8+, pin NumPy to a reviewed version, and keep input and output paths inside the intended workspace. Treat the generated forecasts as analytical estimates, not authoritative research conclusions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned and Unnecessary Third-Party Dependencies
Content: View full analysis
Remediation: View remediation
``` 2. Pin `numpy` to a reviewed version compatible with the supported Python versions. 3. Generate and verify cryptographic hashes, then install with hash enforcement: ```bash python -m pip install --require-hashes -r requirements.txt ``` 4. Use a trusted, explicitly configured package index and prevent unintended fallback to untrusted or internal-name-conflicting indexes. 5. Maintain a lock file or fully resolved requirements file so development and CI installations use the same reviewed dependency graph. 6. Remove `scipy` from `SKILL.md` unless it becomes an actual reviewed runtime dependency. 7. Add automated dependency scanning and scheduled review of pinned versions, updating pins only after compatibility and security validation. 8. Install dependencies in an isolated virtual environment or restricted CI container without unnecessary secrets or host permissions. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill advertises executable Python workflows that read input files and write output files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens policy enforcement and review because a caller cannot tell, from metadata alone, what filesystem capabilities the skill expects, increasing the risk of unintended file access if the runtime grants broader defaults.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency is unpinned, so builds may resolve to different versions over time, reducing reproducibility and potentially pulling in a vulnerable or breaking release. In this specific file, dataclasses is also a backport package that is only needed for older Python versions, so leaving it unpinned can create unnecessary supply-chain risk and compatibility ambiguity.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
dataclasses enum numpy

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 90% confidence
Finding: enum is listed without a version pin, which makes installations non-reproducible and can allow unexpected package versions to be installed. This is especially risky because enum functionality is part of the standard library in modern Python, so a third-party package entry may be unnecessary and could introduce avoidable dependency confusion or compatibility issues.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
dataclasses enum numpy

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: numpy is not version-pinned, so the environment may install different releases at different times. That creates supply-chain and stability risk, and because NumPy has had multiple published advisories across versions, the lack of pinning makes it impossible to verify whether a safe release will be installed.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
dataclasses enum numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 97% confidence
Finding: The manifest includes numpy without a fixed version even though multiple advisories exist for some NumPy releases. Because the version is unspecified, there is no way to confirm that deployments will avoid affected versions, leaving the skill exposed to known vulnerable packages depending on resolution time and environment.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest says the skill calculates literature growth velocity and acceleration to assess research, which suggests descriptive analytics of existing data. The _predict_future method adds forecasting of future publication counts, and analyze includes those predictions in the result, which is additional behavior beyond the stated description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.