upload-fit-to-blackbird-web

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:38 PM UTC
• Version: 1.0.0

Overview

This skill does what it says: it helps upload user-selected FIT activity files to the Blackbird cycling website, with no hidden persistence or unrelated data access found.

Install in an isolated environment if possible, review or pin the Playwright dependency before use, and only pass directories containing FIT files you intend to upload to Blackbird. Expect to log in manually to the Blackbird website during use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned Third-Party Package and Browser Binary Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21-22
Vulnerability Type: Unpinned executable dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

/home/ckboss/anaconda3/bin/pip install playwright
/home/ckboss/anaconda3/bin/playwright install chromium

Technical Analysis

The installation instructions retrieve the current Playwright package and its associated Chromium binary without specifying a reviewed package version, cryptographic hashes, a lock file, or an independently verified browser revision. Consequently, the executable components installed by users can change after the Skill has been audited.

Python package installation may execute package build or installation logic, while the subsequent Playwright command directly executes the installed package and downloads a browser binary. If the package repository, an upstream release, the package distribution process, or the browser download channel is compromised, attacker-controlled code could execute under the identity of the user following these instructions.

This is a supply-chain weakness rather than evidence that the current Playwright project or Chromium binary is malicious.

Attack Path

1. An attacker compromises an upstream package release, distribution account, repository, or browser artifact delivery channel.
2. A user follows the documented installation instructions.
3. pip resolves and installs the uncontrolled current Playwright release.
4. Installation or package build logic may execute with the user's privileges.
5. The user executes the installed playwright command, which retrieves and installs an externally supplied Chromium binary.
6. A malicious package or binary can access resources available to that user and execute arbitrary local actions.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user running the installation comman ...[truncated 314 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin Playwright to a specific reviewed version, for example through an exact playwright==X.Y.Z requirement.
2. Maintain dependencies in a lock file or hash-locked requirements file using --require-hashes.
3. Retrieve packages only from an explicitly configured trusted package index.
4. Pin the compatible Playwright browser revision and verify browser artifacts through checksums or a trusted internal artifact repository where supported.
5. Perform dependency installation in an isolated virtual environment or container with minimal filesystem and network privileges.
6. Add an update process that reviews and tests new dependency versions before changing the pinned versions or hashes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, usage instructions, and all user-facing messages are written only in Chinese, which imposes a specific language on users without opt-in. The stated policy flags language or locale constraints unless the skill offers a choice or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file presents all operational instructions in Chinese and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.