Pre-clinical PK/PD Analyst

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:17 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local PK/PD analysis helper, with the main caveat that its Python dependencies are unpinned.

Install and run this in a virtual environment or container, and prefer pinning reviewed versions of numpy and scipy before using it for regulated or decision-critical PK/PD work. Provide only intended CSV input files, and review outputs as computational assistance rather than validated clinical or regulatory conclusions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Permit Uncontrolled Supply-Chain Changes

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2; installation documented at SKILL.md:125
Vulnerability Type: Unpinned and unhashed third-party dependencies
Risk Level: Medium

Vulnerable code snippet (requirements.txt:1-2):

text

numpy
scipy

Related installation instruction (SKILL.md:125):

text

pip install -r requirements.txt

Technical Analysis

The dependency declarations do not specify exact versions or cryptographic hashes. Each installation can consequently resolve different package releases from the configured package index. This prevents reproducible dependency review and allows newly published, compromised, or otherwise unsafe artifacts to enter the execution environment without a corresponding source-code change in this project.

Python packages can execute code during installation or when imported. The application imports both dependencies in scripts/main.py, so an unsafe resolved artifact could execute with the privileges of the user running the installation or analysis. Uncontrolled version drift can also change numerical behavior and undermine the integrity of pharmacokinetic results.

Attack Path

1. A user follows the documented instruction and runs pip install -r requirements.txt.
2. pip resolves the currently available versions of numpy and scipy from the user's configured package source because no versions or hashes are enforced.
3. An attacker compromises a package distribution channel, account, mirror, or artifact used by that environment.
4. The resolver downloads the attacker-controlled artifact because the requirements file provides no reviewed version or hash constraint.
5. Malicious package code executes during installation or when scripts/main.py imports the dependency.

This path requires compromise or malicious control of a dependency source or resolved artifact; the repository itself does not contain an embedded mali ...[truncated 489 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each direct dependency to an exact, reviewed version, for example:

   text

   numpy==<reviewed-version>
   scipy==<reviewed-version>
   

2. Generate and record cryptographic hashes for all direct and transitive artifacts, then install with:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Use a lock-file workflow that captures transitive dependencies for each supported Python version and platform.
4. Install only from approved package indexes over TLS, and disable untrusted extra indexes or mirrors.
5. Automate dependency vulnerability and provenance scanning in CI.
6. Apply dependency upgrades through a controlled process that reviews release provenance, security advisories, compatibility, and numerical regression results before updating the lock file.
7. Perform installation and analysis in an isolated, least-privileged virtual environment or container.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification includes numpy without a version pin, which makes builds non-reproducible and can lead to unexpected installation of vulnerable or incompatible releases. In a data analysis skill, this is primarily a supply-chain hygiene issue rather than an immediately exploitable flaw, but it can expose downstream environments to known package vulnerabilities or breaking changes.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

numpy
scipy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

numpy has known advisories, and because the manifest does not pin a version, it is impossible to verify whether the installed release is affected. In this context, the risk is contextual and indirect: the package may resolve to a safe version, but the lack of version control leaves the environment open to vulnerable resolutions and difficult-to-audit deployments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency specification includes scipy without a version pin, so installations may resolve to different versions over time, including releases with security defects or incompatible behavior. This weakens reproducibility and increases supply-chain risk, even though the file itself does not indicate active malicious behavior.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

numpy
scipy

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

scipy has known advisories, but the unpinned requirement prevents verification that deployed environments will avoid affected versions. For a preclinical PK/PD analysis skill, this does not inherently increase exploitability, but it does create avoidable supply-chain uncertainty and potential exposure if an insecure version is installed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.