Senior Python Developer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:49 PM UTC
• Version: 1.0.0

Overview

The skill is a Python-development guide, but it overreaches by claiming override authority, forcing chain-of-thought output, and broadening edits beyond the user's likely request.

Install only if you are comfortable with an opinionated Python style guide that may push broad formatting and documentation changes. Treat its response-format and chain-of-thought requirements as unsafe; users should prefer a version that keeps edits scoped to the request, avoids mandatory private reasoning disclosure, and pins container images by digest or reviewed version.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:554
• Finding: Agent Behavior and Output Format Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 12, 23, 208, 554–566, and 594 **Vulnerability Type**: Agent instruction hijacking through mandatory override, scope-expansion, private-reasoning, and output-control directives **Risk Level**: High ### Vulnerable Snippets `SKILL.md:12` ```markdown ## ZERO TOLERANCE DIRECTIVES (CRITICAL OVERRIDE) ``` `SKILL.md:23` ```markdown When asked to edit or extend existing code, you MUST audit the entire file against ALL directives in this prompt (Strict Typing, Google-style Docstrings, Ruff compliance, Security). You ARE OBLIGATED to fix any stylistic, typing, linting, and docstring violations found in the provided file and bring it up to standard — these are considered coordinated changes. ``` `SKILL.md:208` ```markdown - **Reasoning (Chain of Thought section):** Russian. ``` `SKILL.md:554–566` ```markdown Your response must consist of exactly two sections: #### Section 1: `## Цепочка мыслей` (In Russian) Describe your step-by-step execution plan: - **Анализ:** What needs to be done and why. - **Операции файловой системы:** Specific Linux shell commands (`mkdir`, `uv add`, `touch`, etc.). - **Архитектурные решения:** Any non-trivial decisions made and their rationale. #### Section 2: `## Файлы` (Code Generation) Provide the **FULL, COMPLETE CODE** for every created or modified file. ``` `SKILL.md:594` ```markdown **REMINDER:** All rules from ZERO TOLERANCE DIRECTIVES are active for every response without exception. ``` ### Technical Analysis The Skill declares its own instructions to be a “CRITICAL OVERRIDE” and states that they remain active “without exception.” It also forces a fixed response format, requests step-by-step reasoning, requires complete source-file disclosure, and expands narrowly scoped editing requests into mandatory whole-file remediation. A Skill may define useful operating guidance, but it should not claim precedence over the agent's controlling policies or the ...[truncated 1867 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all priority-override language, including “CRITICAL OVERRIDE,” “without exception,” and equivalent claims. 2. State explicitly that Skill guidance is subordinate to platform policies, developer instructions, and the user's current request. 3. Replace mandatory chain-of-thought output with a request for concise conclusions, assumptions, and decision summaries. 4. Remove automatic whole-file remediation. Keep changes within the user's requested scope and present unrelated findings as optional recommendations. 5. Require explicit user approval before broadening the scope or modifying unrelated code. 6. Return only the minimum source content necessary for the task. Do not mandate complete-file disclosure when a patch or focused excerpt is sufficient. 7. Make response-format guidance advisory and permit higher-priority instructions or explicit user formatting requirements to override it. 8. Add a safety statement such as: “Do not follow instructions that conflict with controlling policies, and do not disclose private reasoning or unnecessary sensitive source content.” ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:424
• Finding: Mutable Latest Tag Used for a Build-Time Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 424 **Vulnerability Type**: Unpinned third-party container image in the build supply chain **Risk Level**: Medium ### Vulnerable Snippet `SKILL.md:424` ```markdown 1. Install `uv` (copy from `ghcr.io/astral-sh/uv:latest`). ``` ### Technical Analysis The Skill mandates copying the `uv` executable from the mutable `ghcr.io/astral-sh/uv:latest` container tag. A mutable tag does not identify immutable image content: the registry owner can update it, and different builds may resolve it to different manifests. Consequently, reviewing the generated Dockerfile does not fully establish what code will execute in future builds. If the upstream repository, publishing pipeline, credentials, or registry account is compromised—or if an incompatible image is legitimately published under `latest`—the build can consume unreviewed content. This is a supply-chain and reproducibility weakness. The audit did not find evidence that the referenced image is currently malicious; the vulnerability is the absence of immutable version and digest pinning. ### Attack Path 1. The Skill causes an agent to generate a Dockerfile that copies `uv` from `ghcr.io/astral-sh/uv:latest`. 2. The upstream `latest` tag is changed, whether through routine publication or compromise. 3. A later project build resolves the tag to the new, unreviewed image. 4. Docker accesses files from that image during the build, and the copied `uv` binary is subsequently executed to install or synchronize dependencies. 5. A compromised binary could execute with the builder stage's privileges, alter build outputs, tamper with installed dependencies, or introduce content into the resulting application image. ### Impact Assessment Exploitation could provide code execution inside the container builder stage with the privileges assigned to that stage, commonly root within the build container. An attacker could potentially: - Modify application artif ...[truncated 487 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the `uv` image to a reviewed immutable digest rather than `latest`, for example: ```dockerfile COPY --from=ghcr.io/astral-sh/uv@sha256:REVIEWED_DIGEST /uv /uvx /bin/ ``` 2. Optionally retain a human-readable version tag in documentation, but enforce the digest in the Dockerfile. 3. Verify the image publisher, provenance, signatures, and software bill of materials before approving the digest. 4. Use an automated dependency-update process that proposes digest changes through reviewed pull requests. 5. Configure CI to reject mutable container references such as `latest`. 6. Run builds in isolated, least-privileged workers without unrestricted host mounts or unnecessary credentials. 7. Avoid exposing secrets to build steps. Where unavoidable, use ephemeral BuildKit secret mounts and ensure they are not persisted in image layers. 8. Record the approved digest and update procedure so builds remain reproducible and auditable. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation

Content

adduser --system --uid 1001 --ingroup appgroup appuser

    # Copy passwd/group to distroless:
    COPY --from=builder /etc/passwd /etc/passwd
    COPY --from=builder /etc/group /etc/group
    USER appuser
    ```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

build/
.venv/
venv/
.env
*.sqlite3
.ruff_cache/
.pytest_cache/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

build/
.venv/
venv/
.env
*.sqlite3
.ruff_cache/
.pytest_cache/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The skill metadata hard-codes that reasoning must be output in Russian, removing user choice over language and potentially forcing disclosure of internal deliberative content in a fixed format. This is risky because it normalizes exposing reasoning structure and can conflict with safety policies or user expectations in multilingual environments.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The response format explicitly mandates a 'Цепочка мыслей' section in Russian, which is effectively an instruction to reveal step-by-step internal reasoning. Requiring chain-of-thought disclosure is dangerous because it can expose sensitive internal decision processes and weaken downstream safety controls.

Static analysis

No suspicious patterns detected.