Context Window Economics

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 0.1.1

Overview

This skill is a coherent cost-tracking helper, with the main caution being an unpinned external Python package install.

Install this only in a virtual environment or other least-privilege workspace, and prefer a pinned, reviewed package version before using it with sensitive cost records or private project data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:30

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30–34
Vulnerability Type: Supply-chain risk from an unpinned third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Setup

```bash
pip install context-window-economics

text

### Technical Analysis

The setup instructions install `context-window-economics` directly from the default Python package index without specifying an audited version, verifying package hashes, or using a reviewed lockfile. Consequently, the installed code can change after this Skill has been reviewed.

The dependency's source code is not included in the project, so the audit could not verify its runtime behavior. In particular, the claims in `SKILL.md` that core operations have no network access, telemetry, or data collection cannot be independently confirmed from the supplied artifact.

Python packages may execute package-controlled code during installation, and imported modules execute initialization code within the calling Python process. A compromised maintainer account, malicious future release, or package-index compromise could therefore introduce attacker-controlled behavior.

### Attack Path

1. An attacker compromises the package publisher, distribution channel, or a future package release.
2. The attacker publishes a modified version under the same package name.
3. A user follows the documented setup command without a version or hash constraint.
4. `pip` resolves and downloads the attacker-controlled release.
5. Malicious code executes during installation or when the package is imported by the examples.
6. The code operates with the permissions and resource access of the installing or invoking process.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the current user's privileges. The attacker could read or alter files accessible to that user, tamper with cost-tracking records, access data
...[truncated 363 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a specifically reviewed version, for example:

   bash

   python3 -m pip install "context-window-economics==<reviewed-version>"
   

2. Distribute a hash-locked requirements file and enforce verification:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Review the dependency source and all transitive dependencies before approving the Skill.
4. Use a lockfile and an internal or trusted package mirror to make installation reproducible.
5. Install and run the package in an isolated virtual environment or container with least-privilege filesystem and network access.
6. Add automated dependency integrity, provenance, vulnerability, and unexpected-update checks.
7. Revalidate the documented claims concerning network access, telemetry, secret access, and filesystem boundaries against the exact pinned package contents.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

md

**What it cannot do:**
- Cannot access files outside your working directory beyond what you explicitly specify
- Cannot make purchases, send emails, or take irreversible actions
- Cannot access credentials, environment variables, or secrets
- Does not execute payments — cost allocations are recorded, not processed

**License:** Apache 2.0