Security audit

Gaokao Calculus Bridge

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a Chinese Gaokao math tutoring skill, but it asks for unnecessary API credentials and installs unused unpinned packages.

Review this before installing. The core skill content looks educational and locally scoped, but you should avoid providing API keys unless the publisher explains exactly how they are used, and install it only in an isolated environment or after removing/pinning the unused Python dependencies.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unused and Unpinned Third-Party Dependencies Expand the Software Supply-Chain Attack Surface
Content: View full analysis
Vulnerability Details

File Locations:

requirements.txt:1-5

README.md:20-23

SKILL.md:20-23

SKILL.md:288-290

hermes.config.yaml:7-13

Vulnerability Type: Unnecessary, unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

requirements.txt:1-5:

text
numpy>=1.21.0 matplotlib>=3.5.0 sympy>=1.10.0 pandas>=1.3.0 scipy>=1.7.0

README.md:20-23:

bash
### Install dependencies pip install -r requirements.txt

SKILL.md:20-23:

yaml
install: - id: "python-deps" kind: "pip" packages: ["numpy", "matplotlib", "sympy", "pandas", "scipy"] label: "Install Python dependencies"

hermes.config.yaml:7-13:

yaml
dependencies: - numpy - matplotlib - sympy - pandas - scipy

Technical Analysis

The package directs users and the Skill runtime to install NumPy, Matplotlib, SymPy, Pandas, and SciPy. However, all four bundled Python scripts use only Python standard-library modules; none imports or uses these five packages.

The dependency constraints specify only minimum versions and do not impose upper bounds, exact versions, lockfile resolution, or package hashes. Consequently, two installations performed at different times may resolve to different package versions and transitive dependency graphs. Package installation may also execute build-system or installation hooks with the privileges of the user running pip.

Because the dependencies are unused, this supply-chain exposure provides no functional benefit. Although the audit found no malicious package names or currently embedded malicious dependency code, a future compromise of an allowed package release, transitive dependency, or package-distribution account could affect installations without requiring any change to this repository.

Attack Path

A user installs the Skill according to README.md, or the Skill platform processes the installation metadata in SKILL.md.

The environment runs `pi ...[truncated 1447 chars]
Remediation: View remediation
Remediation Suggestions

Remove unused dependencies

Delete all five entries from requirements.txt.

Remove the corresponding dependency declarations from SKILL.md and hermes.config.yaml.

Update the installation instructions in README.md and the troubleshooting instructions in SKILL.md.

Use the standard library for current functionality

The present scripts require no third-party Python packages, so the safest dependency manifest is empty or absent.

Lock dependencies if future functionality requires them

Pin exact, reviewed versions rather than using open-ended minimum constraints.

Generate a lockfile that captures transitive dependencies.

Require package hashes, such as through pip install --require-hashes.

Review and regenerate the lockfile through a controlled dependency-update process.

Isolate installation

Install dependencies in a dedicated virtual environment or restricted container.

Avoid running package installation as root or an administrator.

Do not expose unrelated secrets or credentials to the installation environment.

Add automated dependency controls

Add CI checks that reject unused dependencies and unlocked production dependencies.

Perform software-composition analysis and vulnerability scanning on every dependency update.

Prefer prebuilt artifacts from trusted indexes and review packages that require local build execution.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The natural-language configuration sets output_language to zh by default, which forces a specific language unless the user or caller explicitly overrides it. The policy allows locale constraints only when users are given a clear choice or when the restriction is explicitly justified; neither is stated here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This markdown file is entirely written in Chinese and presents itself as a general 'real-world case library' and usage guide, but it does not indicate that Chinese is optional or that the skill is intended only for a Chinese-speaking or region-specific audience. Under the policy, a skill that effectively forces a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The module docstring and user-facing descriptions are written only in Chinese, and the skill does not indicate that the language is optional or region-specific. This can violate a language/locale policy when users are not given a choice or informed consent about the enforced language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The argparse description and all formatted output strings are presented only in Chinese, which enforces a specific language for end users. The file does not provide any argument or documented mechanism to select another language, nor does it justify a locale-specific scope.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains user-facing natural-language descriptions and output strings that consistently force Chinese, including the module description and CLI help/output text. Under the policy, language constraints should either provide user opt-in/choice or be clearly documented as region-specific and justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file presents all guidance in Chinese and does not indicate that users can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This markdown file contains user-facing instructions and descriptions exclusively in Chinese, including the title, feature list, usage labels, and surrounding documentation. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest description is entirely Chinese and presents the skill's behavior as Chinese-language by default. The file does not state that users may choose another language or that the locale restriction is intentional and justified, which can conflict with language/locale choice expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations in natural language. This markdown file presents all instructions, prompts, and answers only in Chinese, and nowhere indicates that the user can choose another language or that the skill is intentionally limited to a Chinese-only audience.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The manifest description frames the skill as an educational bridge for contextualized math modeling and interdisciplinary learning, but the runtime configuration requires an OPENAI_API_KEY and optionally accepts third-party visualization/computation credentials. While AI assistance may be plausible, these external-service capabilities are not stated in the skill purpose and introduce capabilities beyond what the description makes explicit.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The dependency is specified with a lower bound only, which allows future unresolved versions to be installed. That weakens reproducibility and can expose deployments to newly introduced vulnerable or incompatible releases through the supply chain.
Content: Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.
text
numpy>=1.21.0 matplotlib>=3.5.0 sympy>=1.10.0 pandas>=1.3.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 88% confidence
Finding: numpy has known advisories, and because the manifest does not pin a concrete version, it is impossible to verify whether the installed release is affected. In practice this means vulnerable versions could be resolved in some environments, leaving risk assessment and patch status uncertain.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: Using an unpinned matplotlib version means installs may resolve to different releases over time. This creates supply-chain and stability risk because a later version could contain a vulnerability or breaking behavior that is not controlled by the project.
Content: Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.
text
numpy>=1.21.0 matplotlib>=3.5.0 sympy>=1.10.0 pandas>=1.3.0 scipy>=1.7.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The sympy requirement is not fixed to a single version, so environments may install different releases. This undermines deterministic builds and increases exposure to accidental adoption of a compromised or vulnerable upstream package version.
Content: Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.
text
numpy>=1.21.0 matplotlib>=3.5.0 sympy>=1.10.0 pandas>=1.3.0 scipy>=1.7.0

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: An unpinned pandas dependency permits uncontrolled upgrades during installation. That can pull in vulnerable or incompatible versions and makes it difficult to verify what code is actually deployed.
Content: Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.
text
numpy>=1.21.0 matplotlib>=3.5.0 sympy>=1.10.0 pandas>=1.3.0 scipy>=1.7.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 ( DISPUTED pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 84% confidence
Finding: pandas has at least one known advisory, and the current unconstrained specification prevents verification that deployed environments avoid affected versions. This uncertainty is a supply-chain weakness because security posture depends on external resolver behavior rather than explicit project control.
Content: No source excerpt is available for this finding.

Unpinned Dependencies

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: The scipy dependency is only minimum-bounded, allowing any newer version to be selected. This creates a low-severity supply-chain risk because the project cannot guarantee the installed version is reviewed, safe, or compatible.
Content: Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.
text
matplotlib>=3.5.0 sympy>=1.10.0 pandas>=1.3.0 scipy>=1.7.0

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: scipy has known advisories, but the dependency is not pinned, so the project cannot demonstrate that only non-affected versions will be installed. This leaves room for vulnerable versions to enter builds and makes incident response and auditing harder.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This Python skill is written entirely with Chinese user-facing text, including the tool description, CLI help text, error messages, and generated report content. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: When no assessment is provided, _diagnose returns dimension entries with score and gap only (L71-L78). format_plan later renders each dimension as info['score']}分（{info['level']}） (L141-L142), which contradicts the implied contract of the diagnostic output and can fail for the default path rather than formatting the advertised personalized plan.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This code file contains natural-language descriptions, docstrings, CLI help text, and generated report content that assume Chinese as the required interaction language. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative or justification is provided.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Undeclared Tool Scope

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Ae4

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Natural-Language Policy Violations

Context-Inappropriate Capability

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unpinned Dependencies

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Unpinned Dependencies

Natural-Language Policy Violations

Intent-Code Divergence

Natural-Language Policy Violations

Static analysis

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 ( DISPUTED pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected