T08 · Insecure Dependencies
Warning
- Location
scripts/anomaly_detect.py:25- Finding
Automatic Installation of Unpinned Runtime Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
AI Anomaly Detection
Security checks for vulnerabilities and agentic risk
Overview
This skill is a legitimate anomaly-detection tool, but it automatically installs unpinned packages and downloads unpinned model/report dependencies in ways users should review first.
Review before installing in shared, production, or sensitive environments. Run it only in an isolated virtual environment or container, preinstall reviewed dependencies, pin the Chronos model/source if possible, and avoid opening reports generated from untrusted JSON files.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/anomaly_detect.py:182- Finding
Unpinned Model Retrieval Through a Third-Party Mirror
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/report_gen.py:310- Finding
Stored HTML Injection in Generated Anomaly Reports
- Content
View full analysis
{a["timestamp"][:19]} {a["actual"]:,.2f} {a["predicted"]:,.2f} {direct_icon} {abs(a["residual_pct"]):.1f}% {a["z_score"]:.1f}σ {a["severity"]} {type_name.get(a["type"], a["type"])} {a["vote_count"]}/4 方法确认 """ if len(anomalies) > 100: anomaly_rows += f'... 还有 {len(anomalies) - 100} 条异常，完整数据见 anomalies.csv' ``` Other JSON-derived values are also interpolated directly into the final HTML: ```python 模型: {metadata.get("model", "amazon/chronos-2")} 数据点: {s["total_points"]} 异常点: {s["anomaly_count"]} ({s["anomaly_rate"]}%) 检测时间: {s["detection_time"]} ``` The assembled document is written without sanitization: ```python output = Path(output_path) output.write_text(html, encoding="utf-8") ``` ### Technical Analysis `report_gen.py` accepts a caller-selected JSON file through `--data` and does not validate it against a strict schema. Several string fields are interpolated directly into HTML without escaping characters such as `<`, `>`, `&`, single quotes, or double quotes. The report generator can be invoked independently, as documented in `SKILL.md`. Therefore, it cannot safely assume its input was generated exclusively by `anomaly_detect.py`. An attacker-con ...[truncated 1882 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (21)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch goes beyond ordinary product drift because the skill claims passive analysis behavior while apparently performing undeclared environment modification and network-related actions such as pip installation. Hidden execution paths and undeclared dependency fetching can expose the host to supply-chain risk, unexpected network access, and user-surprising system changes.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This mismatch goes beyond ordinary product drift because the skill claims passive analysis behavior while apparently performing undeclared environment modification and network-related actions such as pip installation. Hidden execution paths and undeclared dependency fetching can expose the host to supply-chain risk, unexpected network access, and user-surprising system changes.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Self-installing packages via pip gives the script software installation capability unrelated to the narrow business purpose of anomaly detection. This increases supply-chain risk, can alter the runtime unexpectedly, and may execute untrusted installer code from external repositories or mirrors.
- Content
Env Variable Harvesting
High
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
- Content
python print(f"[INFO] 安装依赖: {', '.join(missing)}") import subprocess env = os.environ.copy() if "HF_ENDPOINT" not in env: env["HF_ENDPOINT"] = "https://hf-mirror.com"
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill instructs the agent to use shell, read/write files, and modify the environment (including dependency installation and model download) but does not declare any tool scope or permissions. This creates a least-privilege failure: the skill appears more constrained than it is, reducing reviewability and increasing the chance of unintended file access, command execution, or environment changes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description lists broad trigger phrases such as “异常分析”, “数据异常”, and “找异常点”, which could match ordinary conversation rather than a clear request to invoke this specific skill. The file does not provide exclusion conditions or negative examples to limit when the skill should or should not activate.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description and the entire skill documentation are written as Chinese-only instructions, with no indication that the user can choose another language or locale. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill indicates it may obtain API data and download external models/mirrors, but does not clearly warn users about external network access. In a skill with file, shell, and environment capabilities, undisclosed outbound requests increase privacy, data-governance, and supply-chain risk because user data or metadata may be sent to third parties unexpectedly.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code performs network-dependent dependency installation and later remote model loading, but this behavior is not clearly disclosed in the skill description. Hidden network access and executable package retrieval expand the trust boundary and can surprise operators who expect an offline/local analytics tool.
- Content
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python missing = [] for module, pkg in deps.items(): try: __import__(module) except ImportError: missing.append(pkg)
Dynamic import via __import__()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 75% confidence
- Finding
Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.
- Content
python missing.append(pkg) try: __import__("chronos") except ImportError: missing.append("chronos-forecasting")
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Automatically installing packages without explicit confirmation or a prominent warning removes informed consent for network access and environment modification. In a skill expected to process user datasets, silent package installation is risky because users may not realize the script is performing privileged system changes.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The script automatically invokes pip to install packages at runtime, which can execute arbitrary code from package build/install hooks and silently changes the host environment. In this skill context, that is more dangerous because an anomaly-detection tool is expected to analyze local data, not modify the system or fetch executable content from external registries/mirrors.
- Content
python env["HF_ENDPOINT"] = "https://hf-mirror.com" for pkg in missing: subprocess.check_call( [sys.executable, "-m", "pip", "install", pkg, "-q"], env=env, )
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes accepting CSV/Excel/JSON/pasted/API data and generating an interactive HTML report with multiple visualizations. In this file, input handling is limited to local CSV/Excel/JSON/Parquet files, and output generation only saves JSON and CSV files with no HTML report or visualization generation code.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
Loading the Chronos-2 model from a remote Hugging Face endpoint or mirror introduces undisclosed network dependency and supply-chain exposure. Although model loading does not obviously send the user's dataset, it still downloads external artifacts and may contact third-party infrastructure contrary to user expectations for a local analysis skill.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The code alters the local execution environment by installing a package when an import fails. In a skill advertised for anomaly detection and report generation, this hidden state-changing behavior is risky because it introduces unnecessary privilege, reproducibility, and supply-chain concerns into what should be a read/process/render workflow.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
A report generator should render output from existing data, but this code also performs package installation as a side effect. That exceeds the expected capability of the skill and can surprise operators by changing the system state or pulling code from external repositories during normal report generation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script performs automatic package installation without prior warning or consent, which is unsafe in shared, production, or restricted environments. This can trigger unexpected outbound network access, execute package installation hooks, and make the runtime behavior dependent on external package repositories.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 96% confidence
- Finding
The script automatically invokes pip to install Plotly at runtime, which modifies the local environment and executes network/package-management operations without explicit user approval. Even though the command is hardcoded and not shell-injected, automatic dependency installation increases supply-chain and environment integrity risk if package indexes, mirrors, or the execution context are untrusted.
- Content
python except ImportError: import subprocess print("[INFO] 安装 plotly...") subprocess.check_call([sys.executable, "-m", "pip", "install", "plotly", "-q"]) install_plotly()
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The script's docstring, CLI descriptions, warnings, and status output are written entirely in Chinese, which establishes a fixed language experience for users. There is no indication of locale choice, opt-in, or justification that the skill is intended only for a Chinese-speaking or region-specific context.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
Natural-language strings in the script and generated HTML are fixed in Chinese, including the HTML lang attribute and all user-facing labels. There is no indication that the tool is region-specific or that users can select another language, which may violate language/locale choice policy.
- Content
Static analysis
No suspicious patterns detected.