Sc-RNA Cell Type Annotator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:21 AM UTC
• Version: 1.0.0

Overview

This appears to be a simple local scRNA annotation helper with a supply-chain hygiene issue in an unpinned, unused pandas dependency.

Install this only in an isolated virtual environment and consider removing pandas or pinning it to a reviewed version before use. The inspected artifact does not show hidden network access, credential handling, persistence, or destructive actions, but the dependency declaration should be cleaned up for reproducible installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1, referenced by SKILL.md:119-125; imported at scripts/main.py:8
Vulnerability Type: Unrestricted third-party dependency resolution
Risk Level: Medium

Complete Vulnerable Code Snippets:

requirements.txt:1

text

pandas

SKILL.md:119-125

markdown

## Prerequisites

```text

# Python dependencies
pip install -r requirements.txt

text

`scripts/main.py:7-8`
```python
import argparse
import pandas as pd

Technical Analysis

The project specifies pandas without a version constraint, lockfile, or package hash. Running the documented installation command therefore resolves whichever release and transitive dependencies the configured package index serves at installation time. This makes installations non-reproducible and leaves the project exposed to future upstream compromise, malicious dependency substitution through an improperly configured package index, or an incompatible release.

The dependency is unnecessary for the code currently present. Although pandas is imported, no code uses the pd symbol, and the documented --markers CSV argument is not processed. Keeping an unused dependency increases the supply-chain attack surface without providing functionality.

No evidence indicates that the currently named pandas package is malicious. The vulnerability is the unrestricted and unnecessary dependency resolution process, not a confirmed compromise of pandas itself.

Attack Path

1. A user follows the prerequisite instructions in SKILL.md and runs pip install -r requirements.txt.
2. pip resolves an unrestricted version of pandas and its transitive dependencies from the user's configured package index.
3. If the index, an upstream release, or a transitive dependency is compromised, attacker-controlled installation or package code is downloaded.
4. That code executes with the operating-syst ...[truncated 964 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove pandas from requirements.txt and delete import pandas as pd from scripts/main.py because the current implementation does not use it.
2. If CSV processing is implemented later, prefer Python's standard csv module when its functionality is sufficient.
3. If pandas is genuinely required, pin it to a reviewed version and pin all transitive dependencies through a generated lockfile.
4. Require cryptographic hashes during installation, for example by generating a hash-locked requirements file and installing with pip install --require-hashes -r requirements.txt.
5. Obtain packages only from an explicitly configured trusted index over TLS, and prevent unintended fallback to untrusted or private indexes.
6. Add automated dependency vulnerability and update scanning to CI, reviewing upgrades before regenerating the lockfile.
7. Install dependencies inside an isolated virtual environment or container under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified without a version pin, which makes builds non-reproducible and can cause the skill to install unexpectedly vulnerable or incompatible releases over time. In a data-analysis skill that likely processes user-supplied biological datasets, this increases supply-chain risk even though the manifest itself does not prove active exploitation.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pandas

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 83% confidence

Finding

Because pandas is unpinned, it is impossible to verify from this manifest whether installation will resolve to a version affected by known advisories, including the cited disputed deserialization issue. This uncertainty is a real supply-chain weakness: the environment may pull a vulnerable release depending on install time and resolver behavior.

Content

No source excerpt is available for this finding.