Security audit

Sample Size (Basic)

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local sample-size calculator with ordinary scientific dependencies and no evidence of hidden network, credential, persistence, or destructive behavior.

Install in a normal isolated Python environment, review or pin numpy and scipy before production use, and treat results as preliminary because invalid inputs may crash the tool or produce unreliable calculations.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/main.py:18
Finding: Missing Numeric Domain Validation Allows Process Crashes and Invalid Calculations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file states that Python/R scripts are executed locally and that the skill reads input files and writes output files, which are safety-relevant behaviors. However, the document presents them as risk table entries rather than a clear user-facing warning or caution about system and data impact before use.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency specification leaves numpy unpinned, allowing different environments or future installs to resolve to different versions. This creates supply-chain and reproducibility risk because a vulnerable or breaking release could be installed without review, and the manifest provides no assurance that patched versions are used.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
numpy scipy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 89% confidence
Finding: Numpy has known advisories, and because no version is pinned, it is impossible to determine whether deployments will install an affected release. In this context, the risk is mainly indirect supply-chain exposure rather than immediate exploitability from the requirements file alone, but the uncertainty is still a real security weakness.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: The dependency specification leaves scipy unpinned, so installations may pull different versions over time. That weakens reproducibility and can expose consumers to newly introduced or already known vulnerable releases if dependency resolution changes.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
numpy scipy

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: Scipy has known advisories, and the unpinned manifest prevents verification that a safe version will be installed. While the skill appears to be a basic clinical research calculator rather than a high-risk privileged system component, unresolved dependency version ambiguity still increases supply-chain risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.