AI Anomaly Detection

• Outcome: Review
• Latest audit: Jun 20, 2026 · 3:26 PM UTC
• Version: 1.0.0

Overview

The skill appears to be a time-series analysis/reporting tool, but it can silently install Python packages and download model artifacts during normal use, which deserves manual review before installation.

Install only if you are comfortable with the skill modifying the Python environment and making external package/model downloads during use. Prefer running it in an isolated virtual environment or container, review/pin dependencies first, and avoid using sensitive datasets unless you understand where temporary files and reports are written.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

env["HF_ENDPOINT"] = "https://hf-mirror.com"

        for pkg in missing:
            subprocess.check_call(
                [sys.executable, "-m", "pip", "install", pkg, "-q"],
                env=env,
            )

• Confidence: 98% confidence
• Finding: The script automatically executes pip installs at runtime, which can trigger unreviewed code download and execution from package indexes or mirrors. In a skill that should analyze local time-series data, silently modifying the environment and pulling code from the network is an unjustified and risky capability expansion.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

except ImportError:
        import subprocess
        print("[INFO] 安装 plotly...")
        subprocess.check_call([sys.executable, "-m", "pip", "install", "plotly", "-q"])


install_plotly()

• Confidence: 95% confidence
• Finding: The script invokes pip via subprocess to install Plotly automatically when the import fails. This modifies the runtime environment and triggers external package retrieval during normal execution, which can introduce supply-chain risk or unexpected network activity, especially because it happens implicitly at import/startup rather than through an explicit setup step.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs use of shell execution, file reads/writes, environment variable manipulation, dependency installation, and model download, but declares no permissions. This creates a trust and enforcement gap: a host may allow the skill to appear low-privilege while it actually performs operations affecting the filesystem and network-adjacent configuration, increasing the risk of unintended execution or data exposure.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented behavior understates important side effects: automatic pip installs, external model downloads via HuggingFace mirror, local file creation for pasted data, and a two-step report-generation flow. This mismatch can cause operators or users to approve a skill for offline/local analysis when it actually performs network access and disk writes, which can expose sensitive data or violate execution policy.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The skill advertises anomaly detection, but this block adds environment mutation, network package retrieval, and mirror configuration. That broader behavior increases attack surface and makes the skill more dangerous because users would not reasonably expect installation and external endpoint configuration from a local analysis tool.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Runtime pip installation is a real security issue because it executes package-management operations during normal skill use without prior review. If a dependency, mirror, or package source is compromised, the host running the skill can be made to execute attacker-supplied code.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The report generator auto-installs a package as part of import-time behavior, giving the script the ability to alter the host environment and fetch code from package repositories. In the context of a reporting utility, this is unnecessary privilege and increases operational and supply-chain exposure if the environment is sensitive or offline-controlled.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill description does not clearly warn that execution may involve external network communication for downloading models or interacting with API-based data sources. In a data-analysis context, users may provide sensitive operational or business metrics, so undisclosed network activity materially increases privacy, compliance, and supply-chain risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The workflow says pasted data will be saved as a temporary CSV and results exported to disk, but the description lacks a clear data-handling warning. For potentially sensitive telemetry or business data, silent local persistence increases the risk of residual-data leakage, unauthorized access by other local processes/users, and accidental retention.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Automatically installing packages without any confirmation violates least surprise and weakens operator control over code execution and network access. In a skill context, this is more dangerous because users may invoke analysis on sensitive systems expecting only local data processing, not environment changes.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: Loading a pretrained model via from_pretrained can reach external repositories and download artifacts, which may disclose metadata or introduce supply-chain risk if done silently. While common for ML workflows, it is still a meaningful security concern when not disclosed upfront in a skill expected to process potentially sensitive data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Installing a package through pip subprocess with only a generic info log means users may not realize the tool is making network calls and changing the environment. This weak transparency is risky in enterprise or restricted environments, where silent package installation can violate policy and expose the system to unreviewed third-party code.

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.