cs2-stats-monitor-5e

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:19 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims, but its recommended background monitoring can keep polling 5E services without clear stop or runtime limits.

Review before installing if you do not want an agent starting long-running monitors. Use `--once` for one-time lookups, run monitoring only for explicit player lists, and stop any tmux session when finished. Install Python dependencies in an isolated environment and consider pinning aiohttp before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Unpinned Third-Party Dependency Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: README.md:15-19; duplicated in SKILL.md:91-94
Vulnerability Type: Unpinned dependency installation from a mutable package source
Risk Level: Medium

Vulnerable Code Snippets

README.md:15-19:

markdown

### 1. Install Dependencies

```bash
pip install aiohttp

text

`SKILL.md:91-94`:

```markdown
## Dependencies

- Python 3.10+
- aiohttp (`pip install aiohttp`)

The dependency is imported by scripts/cs_monitor.py:26:

python

import aiohttp

Technical Analysis

The documented installation command retrieves the latest version of aiohttp and its transitive dependencies from the package index configured for pip. No audited version, lock file, package hash, or trusted index is specified.

Dependency resolution is therefore mutable: executing the same documented command at different times or in different environments can install different code. If a future package release, transitive dependency, configured mirror, or package-index account is compromised, malicious code could be installed without any modification to this project.

This finding concerns supply-chain integrity. The audited project itself does not contain evidence that aiohttp is currently malicious, and no malicious payload is embedded in the repository.

Attack Path

1. An attacker compromises a future aiohttp release, one of its transitive dependencies, or a package index or mirror trusted by the victim.

2. A user follows the project's documented command:

   bash

   pip install aiohttp
   

3. Because no version or integrity hash is enforced, pip resolves and installs the attacker-controlled artifact.

4. Malicious package code may execute during package installation or when scripts/cs_monitor.py imports aiohttp.

5. That code runs with the privileges of the user or automation account that installed or launched the monitor.

Impact Assessment

Successful exploitation could permit arbitrary cod ...[truncated 617 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a dependency manifest that pins an audited version:

   text

   aiohttp==X.Y.Z
   

2. Lock all transitive dependencies rather than only the direct dependency. Generate the lock file through a controlled dependency-update process.

3. Record cryptographic hashes and require their verification during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Configure installation to use an explicitly trusted package index and avoid untrusted or implicit mirrors.

5. Install dependencies inside an isolated virtual environment using a non-privileged account.

6. Add automated dependency and vulnerability scanning, and review updates before changing pinned versions.

7. Replace the unpinned commands in both README.md and SKILL.md with the hardened installation procedure so users do not bypass the lock file.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill description uses very broad keywords like 'check stats', 'monitor matches', and 'match report' without clear trigger boundaries, which can cause the agent to invoke this skill for ordinary sports/game-stat requests the user did not intend to route here. Over-broad routing increases the chance of unnecessary network access, unintended monitoring behavior, or use of external scripts in contexts where a simple conversational answer would have been safer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to run continuous polling in the background via tmux, but does not warn that this creates persistent network activity and a long-running process. In an agent environment, that can lead to stealthy resource consumption, unexpected outbound requests, and continued monitoring beyond the user's awareness or intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code hard-codes Accept-Language values of "zh-CN,zh;q=0.8" and "zh-cn" in outbound requests. This imposes a specific locale on all users without opt-in or explanation, matching the policy category for language/locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The instruction "Language Style: Direct, sharp, with a touch of dark humor. No formalities" forces a particular communication style for all users. This is a natural-language policy concern because it imposes a fixed style preference without giving the user an option to choose a different tone.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.