GoldenSeed

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:18 PM UTC
• Version: 1.1.0

Overview

This skill is a disclosed helper for installing and using a deterministic-randomness Python package, with a supply-chain caution from its unpinned dependency.

Install this only in a virtual environment, consider pinning and reviewing a specific golden-seed release before use, and do not use its deterministic output for passwords, keys, security tokens, gambling, or any cryptographic purpose.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: install.sh:3

Finding

Unpinned and Unverified Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Locations:

• install.sh:3
• README.md:66
• SKILL.md:36

Vulnerability Type: Supply-chain exposure through an unpinned and unverified external dependency
Risk Level: Medium

Vulnerable Code Snippets

install.sh:3:

bash

pip install golden-seed

README.md:66:

bash

pip install golden-seed

SKILL.md:36:

bash

pip install golden-seed

Technical Analysis

The installation script and documentation direct users to install golden-seed from the default Python package index without an exact version, package hash, lockfile, or other integrity control. The project does not include the dependency's implementation, so its behavior cannot be audited from the supplied files.

Because the requirement is unpinned, package resolution can select a release published after this project was reviewed. Python packages may execute package-controlled build or installation logic, and their modules execute code when imported. Consequently, compromise of the upstream project, its publishing credentials, the package index, or the dependency-resolution path could introduce code that was not present during this audit.

This finding does not establish that the current golden-seed package is malicious. It identifies an unsafe dependency installation mechanism whose effective code can change independently of the reviewed project.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, or another relevant package distribution channel.
2. The attacker publishes a malicious release under the package name resolved by pip.
3. A user or agent executes install.sh or follows the installation command in the documentation.
4. pip resolves the mutable package release without checking an audit-approved version and cryptographic hash.
5. Malicious code can run during package build or installation, or later when the documented gq ...[truncated 814 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an explicitly reviewed version rather than installing the latest available release:

   text

   golden-seed==<reviewed-version>
   

2. Record cryptographic hashes in a requirements file and enforce them during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate and retain a lockfile or hash-pinned requirements file through a controlled dependency-review process.
4. Install the package in a dedicated virtual environment and avoid running pip as root or with sudo.
5. Audit the selected package artifact, including its build configuration, installation hooks, imported modules, and transitive dependencies.
6. Prefer including or vendoring the minimal deterministic generator implementation when licensing and maintenance requirements permit, allowing the effective code to be reviewed with the skill.
7. Update install.sh, README.md, and SKILL.md so every installation path uses the same pinned and hash-verified dependency specification.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a functional capability: generating deterministic entropy streams for testing and procedural generation. However, the supplied code chunk is only an installation script that installs a Python package. It does not itself implement, expose, or verify the described behavior. Because the actual code’s observable behavior is package installation rather than the declared entropy-generation functionality, this is a mismatch.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.