T08 · Insecure Dependencies
Warning
- Location
SKILL.md:127- Finding
Unpinned Third-Party Dependencies Create a Supply-Chain Risk
- Content
View full analysis
- Remediation
View remediation
Security audit
Data Toolkit
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent local data utility, but it can overwrite source datasets by default and does not clearly warn or constrain that behavior.
Install only if you are comfortable with a local data-processing tool that can rewrite files. Use explicit --output paths, work on copies or backups, and pin dependencies in a virtual environment before use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
src/validate.py:210- Finding
Unrestricted Custom Regular Expressions Permit Regex Denial of Service
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The description overstates the skill as a complete conversion, validation, and cleaning toolkit. This code chunk is specifically a data cleaner. It supports JSON, YAML, and CSV input/output, but not XML. It does not validate schemas at all. While it can incidentally write output in JSON/YAML/CSV based on extension, its primary behavior is cleaning/transformation rather than comprehensive format conversion. It also includes additional cleaning features not mentioned in the description, such as string/date/number normalization and column removal/renaming. Therefore, the declared description does not accurately represent the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The code accurately supports part of the description: conversion among JSON, CSV, YAML, and XML. However, the declared description materially overstates the implemented functionality by claiming validation and cleaning utilities that are absent from the supplied code. There is no schema validation logic, no duplicate detection/removal, and no null-cleaning routine. The only related behavior is light type inference when parsing CSV/XML values, which does not satisfy the declared validation/cleaning capabilities. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The supplied code chunk is specifically a validator utility, not a full conversion/cleaning toolkit. It can load JSON/YAML, validate simplified JSON-schema-like structures, validate CSV headers/rows, infer CSV column types, and apply custom rules. There is no code for converting between formats, no XML parsing or writing, and no cleaning operations such as deduplication or null removal. This is a material description-to-behavior mismatch because major advertised capabilities are absent and the primary purpose is narrower than declared.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./src/clean.py --input data.json --dedupe --key id
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./src/clean.py --input data.json --dedupe --key id
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./src/clean.py --input data.json --dedupe --key id
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./src/clean.py --input data.json --dedupe --key id
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md ./src/clean.py --input data.json --dedupe --key id
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill advertises file-processing functionality and example commands that read from and write to user-supplied paths, but the manifest does not declare any tool scope or allowed-tools boundary. In an agent environment, missing capability declarations weakens least-privilege controls and can allow broader-than-expected file access or data modification without clear user visibility.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill promotes cleaning and batch conversion workflows that can overwrite or materially transform user datasets, yet it provides no warning about destructive outcomes, backups, or safe output practices. In an agent context, this increases the risk of accidental data loss or silent corruption because users may assume operations are non-destructive or reversible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The tool writes back to the input path when --output is omitted, creating a destructive default that can silently destroy the original dataset if cleaning logic removes fields, rows, or reformats data unexpectedly. In a data-processing utility, this is particularly risky because users may run it on valuable source files and only discover data loss after the original has been overwritten.
- Content
Static analysis
No suspicious patterns detected.