Upset Plot Converter

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:44 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local plotting helper with ordinary dependency hygiene issues but no evidence of hidden, destructive, or deceptive behavior.

Install this only in a virtual environment or similarly isolated project environment, pin matplotlib and numpy before production use, and provide only the set data and output path you intend the script to use. The skill appears aligned with local plot generation and does not show hidden network, credential, persistence, or destructive behavior.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unpinned third-party dependencies and non-reproducible package resolution
Risk Level: Medium

Vulnerable Code

text

matplotlib
numpy

The installation instructions in SKILL.md:165-168 directly consume this dependency file:

text

# Python dependencies
pip install -r requirements.txt

Technical Analysis

The project declares matplotlib and numpy without exact versions or package integrity hashes. Each installation can therefore resolve different releases from the configured Python package index. This prevents reproducible dependency resolution and allows future compromised, malicious, or incompatible releases to enter the execution environment without a corresponding change to the audited project.

No evidence of typosquatting, dependency confusion through private package names, or an actively malicious package was identified. The risk arises from mutable dependency resolution and lack of integrity verification.

Attack Path

1. A user follows the documented installation command in SKILL.md.
2. pip queries its configured package index and resolves the latest versions satisfying the unbounded requirements.
3. A compromised upstream release, compromised index response, or unexpectedly incompatible future release is selected.
4. Package installation hooks or imported dependency code execute with the privileges of the user or environment running pip and the Skill.
5. Malicious dependency code could access data and resources available to that process.

Impact Assessment

Successful exploitation through a compromised dependency could result in arbitrary code execution with the installing or executing user's privileges. The accessible scope may include project files, output data, environment variables, credentials available to the process, and network resources permitted by the host environment.

The Skill itself does not request eleva ...[truncated 228 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed exact version, for example:

   text

   matplotlib==<reviewed-version>
   numpy==<reviewed-version>
   

2. Generate a lock file that includes resolved transitive dependencies and cryptographic hashes.

3. Require hash validation during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Configure an explicitly trusted package index or an internally controlled package mirror.

5. Review and update dependencies through a controlled process that includes vulnerability scanning, compatibility tests, and lock-file review.

6. Install and execute the Skill in an isolated, least-privileged virtual environment or container.

7. Reconcile the documentation with the actual implementation: SKILL.md lists pandas, while requirements.txt does not and the script does not import it.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency on matplotlib is unpinned, which makes builds non-reproducible and allows different environments to resolve different versions over time. This increases supply-chain risk because a vulnerable or malicious upstream release could be installed without any manifest change.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

matplotlib
numpy

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency on numpy is unpinned, so installations may pull different versions depending on when and where the skill is deployed. This creates a supply-chain and patch-management gap because vulnerable releases may be installed unintentionally, and behavior is not reproducible.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

matplotlib
numpy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The manifest references numpy without a version, and numpy has multiple historical advisories, so there is no way to verify whether deployments will use a safe release. Even if many advisories are old or context-dependent, the lack of version control means a vulnerable package could be installed in some environments.

Content

No source excerpt is available for this finding.