Security audit
Security checks for vulnerabilities and agentic risk
This pricing skill needs review because its self-test can erase existing files and its crawler can reach unintended network destinations.
Before running, require safeguards against deleting existing self-test destinations and restrict crawler access to approved public sites. Use trusted study files and remove personal or confidential fields before Claude batches. Approve batch costs and any real survey outreach separately, and check pricing recommendations before applying them.
scripts/crawl_site.pyWebsite-controlled redirects bypass the crawler's host boundary
An attacker can cause unsolicited requests to local or private-network services. A successful HTML response can be converted and saved into the study corpus under the original public URL. This does not establish credential theft or transmission of the response back to the attacker.
scripts/selftest.pySelf-test deletes an existing destination without confirming ownership
Permanent loss of files and subdirectories accessible to the process. The deletion precedes the test and is not contingent on successful test execution.
Configuration expressions are evaluated as Python while exposing the full NumPy module and unrestricted attribute access. Removing most builtins does not sandbox eval: NumPy APIs and Python object traversal can enable filesystem access or arbitrary code execution if an attacker influences an expression, so the comment asserting owner trust is not an enforceable security boundary.
"""Evaluate a config expression over numpy arrays. The config files are the owner's own, not untrusted input."""
if isinstance(expr, (int, float)):
return expr
return eval(str(expr), {"np": np, "__builtins__": {"min": min, "max": max, "abs": abs}}, ns)
def git_sha(root: Path) -> str | None:
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def call_cli(prompt, system, model):
env = {k: v for k, v in os.environ.items() if k not in ("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN")}
p = subprocess.run(["claude", "-p", "--model", model, "--output-format", "json", "--tools", "", "--system-prompt", system,
"--no-session-persistence", "--setting-sources", "", "--strict-mcp-config"],
input=prompt, capture_output=True, text=True, timeout=900, env=env, cwd="/tmp")
build() recursively deletes any existing directory supplied through --dir, without checking that it belongs to the self-test or requesting confirmation. A mistaken path or agent-generated invocation can therefore erase an existing study or other valuable directory, despite the documentation describing only construction of synthetic test data.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow sends persona attributes and business-derived valuation cues to an external model without a data-classification, redaction, or disclosure-approval step. These inputs can contain confidential commercial information or identifiable customer details; disabling tools in the respondent process does not protect the data transmitted in its prompt.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- The prompt shows the persona what the value model flagged for its scenario this month. That is the EVC
cue, deliberate, and a declared threat: it invites pricing against value.
- Sample: 4 segments × 4 cells × ≥30 = 480 floor; 60 personas per segment (960 calls) target.
- Run long batches detached (`setsid nohup … &`) so a closed session or tool timeout doesn't kill them;
re-running resumes.
## 4. Analyse
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Running it
- **Keep the study on persistent disk.** A machine or VM restart clears `/tmp` and kills running jobs.
- **Run long jobs detached** (`setsid nohup … &`) and make them resumable; plan session limits interrupt
long panels, and a resumable runner reruns only what's missing.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- The prompt shows the persona what the value model flagged for its scenario this month. That is the EVC
cue, deliberate, and a declared threat: it invites pricing against value.
- Sample: 4 segments × 4 cells × ≥30 = 480 floor; 60 personas per segment (960 calls) target.
- Run long batches detached (`setsid nohup … &`) so a closed session or tool timeout doesn't kill them;
re-running resumes.
## 4. Analyse
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## Running it
- **Keep the study on persistent disk.** A machine or VM restart clears `/tmp` and kills running jobs.
- **Run long jobs detached** (`setsid nohup … &`) and make them resumable; plan session limits interrupt
long panels, and a resumable runner reruns only what's missing.
This workflow step directs a pilot wave using contacts drawn from CRM, lead, or newsletter records, rather than merely describing an available survey tool. It does not warn that sending invitations contacts real people and may repurpose personal data beyond its original consent scope.
Suspicious Unicode normalization or mixed-script content
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def git_sha(root: Path) -> str | None:
try:
return subprocess.run(["git", "-C", str(root), "rev-parse", "HEAD"], capture_output=True, text=True, check=True).stdout.strip()
except Exception:
return None
Suspicious Unicode normalization or mixed-script content
Robots and delay checks apply to the initial URL, but requests follows redirects automatically and browser rendering can make additional requests to unchecked destinations. A competitor-controlled page can therefore bypass the advertised crawl boundary and generate unapproved traffic, potentially reaching internal services when the execution environment permits it.
Suspicious Unicode normalization or mixed-script content
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if p.suffix.lower() == ".pdf":
if not shutil.which("pdftotext"):
return ""
return subprocess.run(["pdftotext", "-layout", str(p), "-"], capture_output=True, text=True).stdout
raw = p.read_text(errors="replace")
if p.suffix.lower() in (".html", ".htm"):
soup = BeautifulSoup(raw, "lxml")
Suspicious Unicode normalization or mixed-script content
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
--free-text keeps replies that are not JSON (response = null, raw kept): the calibration needs this.
llm_batch.py --study S --dir panel --workers 6 [--limit 20] [--expect choices,vw,gg] [--runner cli]
Run long batches detached (setsid nohup ... &): a closed session or a tool timeout then can't kill them.
"""
from __future__ import annotations
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
--free-text keeps replies that are not JSON (response = null, raw kept): the calibration needs this.
llm_batch.py --study S --dir panel --workers 6 [--limit 20] [--expect choices,vw,gg] [--runner cli]
Run long batches detached (setsid nohup ... &): a closed session or a tool timeout then can't kill them.
"""
from __future__ import annotations
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def call_cli(prompt, system, model):
env = {k: v for k, v in os.environ.items() if k not in ("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN")}
p = subprocess.run(["claude", "-p", "--model", model, "--output-format", "json", "--tools", "", "--system-prompt", system,
"--no-session-persistence", "--setting-sources", "", "--strict-mcp-config"],
input=prompt, capture_output=True, text=True, timeout=900, env=env, cwd="/tmp")
try:
Enabling pickle allows a malicious object array in posteriors.npz to execute arbitrary Python code when an affected member is accessed. Although this is normally an internally generated study artifact, an imported or replaced archive crosses a dangerous trust boundary and can compromise files and credentials available to the process.
class PanelDemand:
def __init__(self, st: Study, draws: int):
z = np.load(st.root / "panel/data/posteriors.npz", allow_pickle=True)
b, self.cols, self.scale = z["b"], list(z["cols"]), float(z["scale"])
self.b = b[np.linspace(0, len(b) - 1, min(draws, len(b))).astype(int)]
self.P = len(self.cols)
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run(T, script, *args):
p = subprocess.run([sys.executable, str(HERE / script), "--study", str(T), *args], capture_output=True, text=True, cwd=HERE)
if p.returncode:
raise SystemExit(f"{script} failed:\n{p.stdout[-2000:]}\n{p.stderr[-3000:]}")
return p.stdout
The implementation uses the maximum of the EVC ceiling and panel p75 before calculating window_hi, so a higher panel estimate can relax the documented EVC ceiling. In a pricing skill this is a consequential output-integrity defect: inflated or manipulated panel estimates can produce recommendations above the declared value-based limit.
Suspicious Unicode normalization or mixed-script content
Although the description concerns product pricing, it explicitly lists "packaging" as a trigger without requiring that pricing context. The term also commonly refers to physical packaging or software packaging, creating avoidable invocation collisions.