Virtual Patient Roleplay

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:40 AM UTC
• Version: 1.0.0

Overview

This skill is a local educational patient-roleplay simulator with clear medical-use limits and no evidence of hidden access, persistence, or data exfiltration.

Before installing, consider removing the requirements.txt entries or only installing in an isolated environment. Treat outputs strictly as training simulation, not real medical advice or emergency guidance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unnecessary and Unpinned Standard-Library Replacement Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unnecessary unpinned third-party dependencies and module-shadowing risk
Risk Level: Medium

Vulnerable Code

text

dataclasses
enum

Technical Analysis

The project declares Python 3.8 or later, where dataclasses and enum are included in the Python standard library. Installing identically named third-party distributions is therefore unnecessary.

Both dependencies are unpinned and retrieved through the package index configured in the installation environment. This makes installation non-reproducible and creates avoidable supply-chain exposure. A malicious or compromised package, package-index substitution, or incompatible distribution could run installation logic or introduce modules that shadow trusted standard-library modules.

The reviewed project does not contain an automatic package-installation command, and the audit found no evidence that either declared package is currently malicious. The finding concerns the unnecessary attack surface created if a user or automated deployment installs the requirements.

Attack Path

1. A user or deployment process executes pip install -r requirements.txt.
2. pip resolves the unpinned dataclasses and enum names using the configured package index.
3. Third-party package artifacts and any associated installation logic are downloaded and executed.
4. A compromised or substituted distribution may install attacker-controlled modules.
5. Those modules may shadow standard-library imports or execute malicious installation behavior within the privileges of the installing process.

Exploitation depends on compromise or manipulation of the package source or resolution environment; it is not performed directly by the reviewed simulator code.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the account performing package installation. In a developer environmen ...[truncated 396 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove both dataclasses and enum from requirements.txt.
2. Delete requirements.txt if the project has no external runtime dependencies, or retain it as an empty documented file if required by packaging conventions.
3. Enforce the documented Python 3.8-or-later runtime through packaging metadata or deployment checks.
4. If third-party dependencies are added later, pin reviewed versions and use cryptographic hashes, such as through pip install --require-hashes.
5. Install dependencies only from trusted, explicitly configured indexes and scan dependency changes during continuous integration.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

dataclasses
enum

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

dataclasses
enum

Static analysis

No suspicious patterns detected.