Back to skill

Security audit

Pandas Construction Analysis

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Pandas reference for construction data analysis, with expected user-directed file reading and export examples.

Install only if you want the agent to analyze construction datasets with Pandas. Provide file paths deliberately, review generated code before running it on important project data, and use unique export filenames because examples such as output.csv or project_report.xlsx could overwrite existing files.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The documentation presents a bilingual book reference and a Russian quotation, but it does not state whether the skill supports multiple languages or why Russian text is required. This can conflict with language/locale policy expectations when a specific language is introduced without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes export examples that create Excel and CSV files such as "project_report.xlsx", "output.csv", and "volumes.csv", but the surrounding documentation does not warn users that running these snippets will write files to disk and may overwrite existing files. Under the markdown-file criteria, user-facing documentation should disclose behaviors that can affect user data or system state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.