Volcano Plot Labeler

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:41 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward local volcano-plot generator, with ordinary data-file access and dependency hygiene issues but no evidence of hidden, persistent, networked, destructive, or deceptive behavior.

Install in an isolated Python environment, pin or lock dependency versions before production use, and provide only the intended CSV/TSV input and output paths. Do not treat the checklist's path-validation and workspace-restriction items as implemented safeguards.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-3
Vulnerability Type: Unpinned and unverified package dependencies
Risk Level: Medium

Complete Code Snippet:

text

matplotlib
numpy
pandas

The installation documentation also uses unconstrained dependencies:

text

pip install pandas matplotlib numpy scipy

text

pip install -r requirements.txt

These commands appear at SKILL.md:111 and SKILL.md:229, respectively. The first command also introduces scipy, which is absent from requirements.txt and unused by the reviewed implementation.

Technical Analysis

The project specifies neither exact dependency versions nor cryptographic hashes. Consequently, each installation resolves whatever distributions the configured package index currently considers suitable. This makes installations non-reproducible and prevents verification that downloaded artifacts are the versions reviewed and approved by the project.

The issue is a supply-chain weakness rather than evidence that the currently named packages are malicious. Exploitation requires compromise of a configured package source, package or maintainer account, dependency-resolution environment, or another mechanism that causes pip to select an attacker-controlled artifact.

Attack Path

1. An operator follows the installation instructions in SKILL.md.
2. pip resolves the unconstrained package names using the operator's configured indexes.
3. An attacker compromises an upstream release channel or otherwise causes a malicious distribution to be selected.
4. The malicious package executes installation-time behavior, or malicious code runs when scripts/main.py imports the package.
5. That code executes with the privileges of the user or automation account running the installation or skill.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing or ru ...[truncated 428 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to an explicitly reviewed version.
2. Generate a lock file containing all transitive dependencies and cryptographic hashes.
3. Install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
4. Use a trusted, explicitly configured package index or an internally controlled artifact repository.
5. Add automated dependency vulnerability and integrity scanning to the release process.
6. Update dependencies through a controlled review process rather than resolving new releases during routine installation.
7. Remove scipy from SKILL.md unless it becomes a documented and reviewed runtime dependency.
8. Keep installation instructions synchronized with the authoritative locked dependency manifest.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The description only partially matches the code. The code does include some reproducibility/validation aspects via a command-line workflow and explicit column/file checks. However, its primary purpose is not broad data analysis with structured outputs; it specifically creates a volcano plot image and labels top significant genes using a repulsion algorithm. The declared description emphasizes 'structured outputs for review-ready interpretation,' but the implementation outputs a matplotlib figure/image and simple console logs, not structured review artifacts. This is a material description-behavior mismatch in primary function and output type.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Lines L014-L015 say to use the skill for general 'data analysis tasks' requiring bounded scope, reproducibility, or fallback handling, which are common characteristics of many unrelated skills. This trigger guidance is not specific enough to volcano plots or gene-labeling, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The audit-ready example commands conflict with the documented input model by passing a narrative text string to --input where the rest of the skill expects a CSV/TSV file path. This kind of inconsistency is dangerous because operators may execute the wrong workflow, bypass intended validation assumptions, or trigger unexpected script behavior and unsafe error-handling paths.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The security checklist asserts protections such as path validation and restricting outputs to the workspace, but the surrounding documentation does not define or demonstrate those controls. False assurances are security-relevant because users may trust the skill with sensitive files or broader filesystem access under the mistaken belief that traversal and unsafe output paths are already prevented.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency specification for matplotlib is unpinned, which makes builds non-reproducible and allows future installs to pull different versions over time. This can introduce vulnerable or breaking releases unexpectedly through the supply chain, even though the package itself is common and there is no direct evidence of malicious intent.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

matplotlib
numpy
pandas

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency specification for numpy is unpinned, so installations may resolve to different versions depending on timing and environment. In a security context this is dangerous because it prevents assurance that a safe release is installed and increases exposure to known or newly introduced vulnerable versions.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

matplotlib
numpy
pandas

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Numpy has known advisories, and because no version is pinned, it is impossible to verify whether the installed release is affected. The skill context is a data-analysis workflow, which does not inherently raise risk, but the lack of version control still creates avoidable supply-chain uncertainty.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency specification for pandas is unpinned, which weakens reproducibility and supply-chain control. This can lead to accidental installation of vulnerable or incompatible versions and makes it harder to audit what code actually runs.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

matplotlib
numpy
pandas

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Pandas has a known advisory history, and the unpinned requirement means the deployed version cannot be verified as safe. While this skill’s stated purpose is ordinary data analysis rather than high-risk execution, unresolved dependency ambiguity still increases supply-chain and maintenance risk.

Content

No source excerpt is available for this finding.