Resubmission Deadline Tracker

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but its unnecessary unpinned install dependencies create an avoidable review-worthy supply-chain risk.

Install only if you are comfortable reviewing or removing the requirements.txt dependencies first. The runtime behavior appears local and purpose-aligned, but avoid running pip install -r requirements.txt as written; also verify deadline timezone calculations manually for important submissions and be careful with the delete command because it removes local records without confirmation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary and Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–2
Vulnerability Type: Dependency confusion and unpinned supply-chain exposure
Risk Level: Medium

Complete Code Snippet:

text

dataclasses
enum

Technical Analysis

The project declares unpinned PyPI dependencies named dataclasses and enum. In the Python versions suitable for this project, both names correspond to modules already provided by the Python standard library and imported by scripts/main.py. Therefore, downloading identically named external packages is unnecessary.

Because neither dependency is pinned to an exact, verified artifact, installation behavior can change without any modification to this repository. Installing the requirements may retrieve mutable third-party distributions and invoke their package installation or build logic. The generic enum package also risks shadowing or conflicting with Python's standard-library enum module.

This creates avoidable package-repository and dependency-confusion exposure. The audit found no evidence that the currently named packages are malicious; the vulnerability is the unnecessary trust boundary and lack of version or artifact integrity controls.

Attack Path

1. A user or automated build process runs pip install -r requirements.txt.
2. The package resolver queries its configured public or private package index for distributions named dataclasses and enum.
3. An attacker compromises a referenced distribution, publishes a malicious version through an index-resolution weakness, or influences a private index to resolve an attacker-controlled artifact.
4. The resolver downloads the unverified package because no exact version or hash is specified.
5. Malicious installation/build logic executes with the privileges of the user or CI process running pip, or malicious package code is later imported through module shadowing.

Impact Assessment

Successful e ...[truncated 559 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both dependencies because dataclasses and enum are available from the Python standard library on supported Python versions.

2. Declare and enforce a minimum supported Python version instead of installing standard-library substitutes.

3. If legacy Python support genuinely requires a dataclasses backport, use an explicit environment marker, an exact reviewed version, and a cryptographic hash. For example:

   text

   dataclasses==<reviewed-version> ; python_version &lt; "3.7" \
       --hash=sha256:<verified-artifact-hash>
   

4. Do not install the external enum distribution; use the standard-library enum module.

5. Configure CI to install dependencies with hash verification, such as pip install --require-hashes -r requirements.txt.

6. Use an approved package index or repository proxy and periodically scan locked dependency artifacts for known compromise or vulnerabilities.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises executable commands against scripts/main.py and the analyzer detected file read/write capability, but the manifest does not declare any explicit tool scope or permissions. That creates an authorization ambiguity: an agent or reviewer cannot tell what filesystem access is intended, increasing the risk of over-broad file operations or unsafe execution in environments that rely on manifest-declared boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This code file performs a destructive operation by removing a tracked deadline and rewriting the JSON store, but the function only has a minimal docstring and no user-facing confirmation inside the deletion path. In interactive mode and CLI mode, the user receives success output after deletion, but there is no prior warning or confirmation before the irreversible change is made.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Defaulting to Asia/Shanghai without user opt-in can silently miscalculate deadlines for users in other regions, which is especially relevant for time-sensitive manuscript resubmissions. While this is not a code-execution issue, it can cause incorrect urgency classification and task schedules, leading to missed submission windows or unnecessary escalation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code sets a default timezone of Asia/Shanghai, which imposes a locale-specific behavior on all users unless they inspect or override internals. The policy allows locale constraints when they are user-selectable or clearly justified, but this file does not present that choice or rationale in its user-facing interface.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.