Historical Cost Analyzer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:06 AM UTC
• Version: 2.0.0

Overview

This skill is a straightforward construction cost analysis helper with proportionate local data access and no hidden or destructive behavior.

Install dependencies in an isolated environment and consider pinning reviewed versions. Only give the skill construction cost data you intend it to analyze, especially if project histories include confidential business information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:420

Finding

Unpinned Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 420
Vulnerability Type: Unpinned third-party package installation
Risk Level: Medium

Vulnerable Code:

bash

pip install pandas numpy scipy

Technical Analysis

The installation command retrieves pandas, numpy, and scipy without pinning reviewed versions, verifying package hashes, using a lockfile, or explicitly restricting resolution to a trusted package index. Consequently, the code installed in the future may differ from the dependencies represented at audit time.

Python package installation can execute package build and installation logic. If the package repository, an upstream release, the package-resolution configuration, or the network path is compromised, following this command could result in execution of attacker-controlled code. Unpinned dependencies also introduce non-malicious dependency drift, potentially changing analytical results or breaking compatibility.

Attack Path

1. An attacker compromises an upstream package release, dependency, configured package index, or package-delivery path.
2. A user follows the dependency installation instructions in SKILL.md.
3. pip dynamically resolves and downloads the affected mutable package artifact.
4. Malicious build or installation logic executes with the privileges of the user running pip.
5. The installed package can execute additional malicious behavior when imported by the cost-analysis code.

This path requires compromise or malicious manipulation of the dependency supply chain; the audited project does not itself specify a malicious package or external package source.

Impact Assessment

Successful exploitation could execute code with the privileges of the user who installs or imports the dependencies. Depending on those privileges, an attacker could access local files available to that user, including construction datasets processed by the Skill, modify the Python environment, tamper with ana ...[truncated 161 chars]

Remediation

View remediation

Remediation Suggestions

1. Move dependency declarations into a version-controlled requirements or lock file.
2. Pin each direct and transitive dependency to a reviewed version.
3. Record and enforce cryptographic hashes using pip install --require-hashes -r requirements.txt.
4. Explicitly use an approved HTTPS package index and prevent fallback to untrusted indexes.
5. Install dependencies in an isolated virtual environment with no unnecessary privileges.
6. Use automated dependency scanning and periodically update pins through a controlled review process.
7. Test dependency updates for analytical correctness and compatibility before release.

Example hardened installation pattern:

bash

python -m venv .venv
. .venv/bin/activate
python -m pip install --index-url https://pypi.org/simple \
  --require-hashes -r requirements.txt

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.