T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/dataset.py:209- Finding
Untrusted Hugging Face dataset loading can execute repository-controlled code
- Content
View full analysis
- Remediation
View remediation
Security audit
Dataset Finder
Security checks for vulnerabilities and agentic risk
Overview
This dataset skill is purpose-related but should be reviewed because it can load remote datasets and read or write local data with weak scoping and some overstated documentation.
Install only in a virtual environment or container, avoid running arbitrary Hugging Face dataset IDs from untrusted sources, do not preview private datasets unless raw rows are safe to display, review generated data cards before sharing or committing them, and pin dependencies before use in sensitive environments.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/requirements.txt:1- Finding
Unpinned dependencies create an avoidable package supply-chain risk
- Content
View full analysis
=1.5.0 # Hugging Face datasets datasets>=2.14.0 huggingface-hub>=0.17.0 # Data processing pandas>=2.0.0 # Web scraping (for UCI, Data.gov) requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 # Optional: For better performance pyarrow>=13.0.0 # Fast Parquet support fastparquet>=2023.0.0 # Alternative Parquet engine ``` The primary installation instructions also recommend installing unresolved package names directly: ```bash pip install kaggle datasets pandas huggingface-hub requests beautifulsoup4 ``` ### Technical Analysis Every dependency uses an unrestricted lower-bound constraint, and the direct installation command does not specify versions at all. No lock file, artifact hashes, or verified package source configuration is provided. As a result, two installations performed at different times can resolve to materially different dependency trees. A compromised future release, compromised maintainer account, or unsafe transitive dependency could therefore be selected automatically. Python package installation may execute build backend or installation logic before the Skill itself is run. This finding does not establish that any listed package is currently malicious. The vulnerability is the absence of controls that make dependency selection reproducible and resistant to supply-chain compromise. ### Attack Path 1. A direct or transitive dependency publishes a compromised release, or its package-distribution account is compromised. 2. A user follows the documented installation command or installs `scripts/requirements.txt`. 3. Because the requirements accept any later compatible version and do not verify hashes, the re ...[truncated 865 chars]- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (26)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The documentation claims repository support and behaviors that static analysis indicates are not actually implemented, including Data.gov support and broader multi-repository exploration. This mismatch is dangerous because users and orchestration systems may trust the skill to perform actions or validations it cannot do, leading to unsafe decisions, unexpected fallbacks, or invocation of unintended code paths.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents capabilities that clearly require network access and local file creation/modification, but it declares no explicit tool scope or permissions. In an agent environment, missing scope boundaries can allow the skill to be invoked with broader-than-expected authority, increasing the chance of unintended downloads, file writes, or data exposure.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The trigger language is very broad and can match many ordinary conversations about datasets, data exploration, or ML projects. Overbroad activation increases the chance this skill is invoked in contexts where network access, downloads, local enumeration, or file generation were not intended, which can expose data or perform unnecessary side effects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill extensively documents downloading remote datasets, listing local datasets, previewing files, and generating documentation, but it does not warn that these actions may read sensitive local content or create persistent artifacts on disk. In agent use, that omission makes accidental disclosure and unintended file creation more likely, especially when previewing arbitrary CSVs or writing README/datacard outputs.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The workflow explicitly creates persistent local directory structures and stores downloaded datasets and metadata for later reuse. Persistent storage is risky in this context because datasets may contain sensitive or licensed content, and leaving them on disk can expose data to other tools, users, or future sessions without clear retention controls.
- Content
Organize datasets for team use.
bash # Create organized structure mkdir -p datasets/{kaggle,huggingface,uci,custom} # Download datasets with metadata
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation advertises additional dataset-management operations beyond the stated scope, such as validation, conversion, splitting, and merging workflows. Scope expansion in documentation can cause an agent or user to attempt higher-risk local data operations without appropriate review, especially when those actions read, transform, and write potentially sensitive files.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The markdown lists commands that are unsupported or contradictory relative to the command reference, which can mislead users or agent planners about what actions are available. In security terms, contradictory docs increase the risk of fallback behavior, unsafe substitutions, or execution of unintended commands when expected functionality is absent.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md #### Kaggle Setup 1. Go to https://www.kaggle.com/settings 2. Click "Create New API Token" 3. Save `kaggle.json` to: - Linux/Mac: `~/.kaggle/` - Windows: `%USERPROFILE%\.kaggle\`
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 3. Save `kaggle.json` to: - Linux/Mac: `~/.kaggle/` - Windows: `%USERPROFILE%\.kaggle\` 4. Set permissions (Linux/Mac): `chmod 600 ~/.kaggle/kaggle.json` #### Hugging Face Setup (Optional)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Or %USERPROFILE%.kaggle\kaggle.json (Windows)
Set permissions (Linux/Mac)
chmod 600 ~/.kaggle/kaggle.json
text ### "Library not installed"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Or %USERPROFILE%.kaggle\kaggle.json (Windows)
Set permissions (Linux/Mac)
chmod 600 ~/.kaggle/kaggle.json
text ### "Library not installed"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The preview functionality returns and prints raw sample rows from user-supplied datasets via
df.head(sample_size).to_dict('records')and later formats them for console or file output. In a dataset-finder skill, users may inspect proprietary or sensitive datasets, so echoing actual records without redaction, warning, or an opt-in disclosure control can leak PII, secrets, or confidential business data into logs, terminals, or downstream agents.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The data card generator embeds
df_sample.to_string()directly intoDATACARD.md, persisting raw dataset rows to disk. This creates a durable copy of potentially sensitive records in documentation artifacts that are easy to commit, share, or publish, increasing accidental disclosure risk beyond transient console preview.- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file documents dataset downloads and later output generation, which affect the user's filesystem, but it does not explicitly warn that files will be created locally or that large datasets may use substantial disk space. Although disk-space troubleshooting appears later, the operational sections themselves lack a clear up-front user warning about these data-affecting behaviors.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The dependency is specified with a lower bound only, so future installs may resolve to different versions over time. This weakens build reproducibility and can inadvertently pull in a vulnerable or breaking release, which is relevant for a skill that fetches data from external services.
- Content
text # Dataset Finder - Python Dependencies # Kaggle API kaggle>=1.5.0 # Hugging Face datasets datasets>=2.14.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Using an unpinned version for the datasets package means the installed artifact is not deterministic and may drift to a release with security regressions. In a dataset-finder skill that downloads and processes remote data, dependency drift increases supply-chain exposure.
- Content
text kaggle>=1.5.0 # Hugging Face datasets datasets>=2.14.0 huggingface-hub>=0.17.0 # Data processing
Unverifiable Dependency: datasets has 1 known advisory(ies) (CVE-2026-66007 (Datasets through 5.0.0, fixed in commit f989ef9, contains a path traversal vulne)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The manifest does not pin datasets, and the package has at least one known path traversal advisory affecting some versions. Because the skill downloads and processes datasets from external sources, an affected release could increase risk when handling crafted archives or repository content.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The huggingface-hub package is not pinned, so installations are not reproducible and may unexpectedly adopt a compromised or vulnerable release. This matters because the skill interacts with remote model/data hosting infrastructure and relies on the client library for authentication and downloads.
- Content
text # Hugging Face datasets datasets>=2.14.0 huggingface-hub>=0.17.0 # Data processing pandas>=2.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
An unpinned pandas dependency allows uncontrolled upgrades and makes it unclear which code is actually executing in production. While common in development, this is still a supply-chain and reproducibility weakness, especially when handling untrusted dataset content.
- Content
text huggingface-hub>=0.17.0 # Data processing pandas>=2.0.0 # Web scraping (for UCI, Data.gov) requests>=2.31.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Requests is unpinned, so future installs may silently change behavior or include newly introduced vulnerabilities. Because this skill performs outbound HTTP requests to data repositories, the networking library is security-sensitive and should be tightly controlled.
- Content
text pandas>=2.0.0 # Web scraping (for UCI, Data.gov) requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
Requests has a substantial advisory history, and without an exact pin it is not possible to prove that deployed environments avoid affected versions. Since this skill makes network requests to external data sources, weaknesses in the HTTP client can have direct security consequences such as credential leakage or TLS/verification issues.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
BeautifulSoup4 is specified with only a minimum version, which reduces reproducibility and allows environment-dependent resolution. Although not inherently dangerous alone, it contributes to supply-chain uncertainty in code that parses remote HTML content.
- Content
text # Web scraping (for UCI, Data.gov) requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 # Optional: For better performance
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The lxml dependency is unpinned, creating non-deterministic builds and increasing the chance of pulling a version with known parser-related flaws. This is more relevant here because the skill scrapes and parses external web content, which expands exposure to malicious input.
- Content
text # Web scraping (for UCI, Data.gov) requests>=2.31.0 beautifulsoup4>=4.12.0 lxml>=4.9.0 # Optional: For better performance pyarrow>=13.0.0 # Fast Parquet support
Unverifiable Dependency: lxml has 14 known advisory(ies) (CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +11 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Lxml has multiple historical security advisories, and the unpinned manifest leaves the effective installed version unverifiable. In a skill that scrapes and parses remote HTML/XML, using an unverified parser version increases exposure to crafted content that could trigger parser-related flaws.
- Content
Static analysis
No suspicious patterns detected.