Sanfrancisco Today Festivalevents Agent

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:09 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: it fetches public San Francisco event listings and can store them locally for search, with some ordinary setup and disclosure caveats.

Install this only if you are comfortable with it making requests to SF Funcheap and writing a local ChromaDB database under ./rag_db. Use a virtual environment and pinned dependency versions where possible.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:19

Finding

Unpinned Third-Party Dependencies Allow Uncontrolled Package Resolution

Content

View full analysis

Vulnerability Details

File Location: README.md:19
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

bash

pip install requests beautifulsoup4 chromadb

Technical Analysis

The documented installation command installs three third-party packages without version constraints, a lockfile, or cryptographic hash verification. Consequently, each installation resolves whatever package versions the configured Python package index serves at that time rather than a reproducible, previously reviewed dependency set.

This creates a supply-chain exposure: compromise of an upstream package release, dependency account, or package-index resolution path could cause users to install attacker-controlled code. Python packages may execute code during installation, and imported packages execute module initialization code at runtime.

The audit did not identify evidence that the currently named packages are malicious. The risk arises from uncontrolled future package resolution and absent integrity controls.

Attack Path

1. An attacker compromises an upstream dependency release process, maintainer account, or package-index resolution path.
2. The attacker publishes or causes delivery of a malicious version of requests, beautifulsoup4, chromadb, or a transitive dependency.
3. A user follows the installation command from README.md.
4. pip resolves and installs the uncontrolled malicious release because no reviewed versions or hashes are required.
5. Attacker-controlled code executes during package installation or when the application imports the affected package.

Impact Assessment

Malicious package code would ordinarily execute with the privileges of the user running pip or launching the application. It could access files, environment variables, local application data, and network resources available to that account. If installation is performed with elevated privi ...[truncated 273 chars]

Remediation

View remediation

Remediation Suggestions

1. Define direct dependencies using exact, reviewed versions in a dependency manifest.
2. Generate and commit a lockfile that includes the complete transitive dependency graph.
3. Record and enforce cryptographic hashes for all resolved artifacts, such as with:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Configure installation to use a trusted package index and avoid unreviewed alternate indexes.
5. Add automated dependency vulnerability and provenance scanning to the release workflow.
6. Regularly update dependencies through reviewed changes rather than resolving mutable latest versions during installation.
7. Perform installation in an isolated virtual environment under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill instructs the agent to run a Python script that performs live scraping, which implies network access, but the manifest declares no explicit tool scope or permissions. This creates a governance gap: an agent or reviewer cannot reliably determine or constrain the skill's external access, increasing the risk of unintended outbound requests, data exfiltration, or execution in environments that assume stricter sandboxing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file states that the skill performs direct scraping of event sources and stores data in a local ChromaDB database, but it does not include any user-facing warning about outbound network activity or local persistence. For markdown files, omitted disclosure of behaviors affecting privacy or system state qualifies as a missing warning.

Content

No source excerpt is available for this finding.