Pypi Package Changelog Generator

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:35 AM UTC
• Version: 0.2.1

Overview

The skill mostly does what it claims, but it needs review because it can process unbounded PyPI source archives and includes a plaintext GitHub token configuration example.

Install only if you are comfortable with the skill making outbound requests to PyPI and GitHub and processing source archives from the packages you ask about. Prefer no GitHub token, or a short-lived read-only token via environment/apiKey injection; avoid direct plaintext token values in config. Run it with normal agent time, memory, and temporary-storage limits, especially for untrusted or unusually large PyPI packages.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/pypi_package_changelog_generator/archive_diff.py:88

Finding

Unbounded Source Archive Processing Enables Resource Exhaustion

Content

View full analysis

bytes: try: response = self._client.get(url) except HttpTransportError as exc: raise PypiClientError( code="pypi_download_failed", message=f"Failed to download source archive from {url}.", retryable=True, ) from exc if response.status_code >= 400: raise PypiClientError( code="pypi_download_failed", message=f"Failed to download source archive from {url}.", retryable=True, ) return response.content ``` `src/pypi_package_changelog_generator/archive_diff.py:88-105`: ```python def extract_archive(content: bytes) -> ExtractedArchive: temp_dir = tempfile.TemporaryDirectory(prefix="pypi-changelog-") root = Path(temp_dir.name) root_resolved = root.resolve() try: with tarfile.open(fileobj=BytesIO(content), mode="r:gz") as archive: members = archive.getmembers() for member in members: if not _is_safe_tar_member(root_resolved, member): raise ArchiveDiffError( code="uns ...[truncated 3639 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Providing only version parsing/normalization/comparison instead of full package version-change auditing is a significant underdelivery relative to the declared purpose. In security terms, this is risky because it combines false assurances with potentially unnecessary access to network, files, shell, and environment variables.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares capabilities that imply shell, network, file read, and environment-variable access, but it does not define any explicit tool scope such as allowed-tools or permissions. This increases the blast radius if the skill implementation or prompt routing is abused, because the runtime may grant broader access than the task strictly requires.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation explicitly shows storing a GitHub token directly inside a configuration file, but does not warn that this creates a plaintext secret at rest. Such files are commonly copied, backed up, committed by mistake, or exposed through local compromise, which can lead to token theft and unauthorized access to GitHub resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The client’s URL resolution logic allows any absolute http(s) URL to bypass the configured base_url, so callers expecting a PyPI-scoped client can be induced to send requests to arbitrary external hosts. In a package-analysis skill, this expands the trust boundary and can enable SSRF-style outbound requests, metadata probing, or accidental leakage of request headers to attacker-controlled endpoints if untrusted input reaches the path parameter.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · vendor/packaging/_musllinux.py (reported line 52)May include surrounding context.

python

return None
    if ld is None or "musl" not in ld:
        return None
    proc = subprocess.run([ld], check=False, stderr=subprocess.PIPE, text=True)
    return _parse_musl_version(proc.stderr)

compile() call detected

Medium

• Category: Dangerous Code Execution
• Confidence: 65% confidence

Finding

compile() creates code objects from strings. When combined with exec()/eval(), it enables obfuscated code execution.

Content

Scanner excerpt · vendor/packaging/licenses/__init__.py (reported line 144)May include surrounding context.

python

python_expression = " ".join(python_tokens)
    try:
        compile(python_expression, "", "eval")
    except SyntaxError:
        message = f"Invalid license expression: {raw_license_expression!r}"
        raise InvalidLicenseExpression(message) from None