T09 · Insecure Skill Coding Practices
Error
- Location
predictor/ml_enhancer.py:21- Finding
Unsafe Joblib Deserialization Enables Arbitrary Code Execution
- Content
View full analysis
- Remediation
View remediation
Security audit
yyWorldCup
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches a World Cup prediction tool, but it also includes under-disclosed self-modification and broad packaging code that users should review before installing.
Install only if you are comfortable reviewing or removing the auto_evolution modules first. Avoid running the evolve, tune, or apply commands in a directory containing secrets or unrelated files, do not trust model .pkl files from untrusted sources, and rotate the exposed API key if it belongs to you.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
predictor/auto_evolution.py:31- Finding
Hardcoded API Credential Exposed in Source Code
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
predictor/auto_evolution.py:443- Finding
Package Generator Recursively Archives the Unrestricted Working Directory
- Content
View full analysis
Path: """Generate a ZIP package for the new version.""" import zipfile zip_path = Path(f"/tmp/yy-world-cup-v{version}.zip") if zip_path.exists(): zip_path.unlink() with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zf: base = Path(".") for file_path in base.rglob("*"): if file_path.is_file() and "__pycache__" not in str(file_path): if ".cache" in str(file_path) or "data/auto_evolution" in str(file_path): continue arcname = file_path.relative_to(base) zf.write(file_path, arcname) ``` ### Technical Analysis The package generator uses `Path(".")` as its archive root and recursively reads every file under the process's current working directory. Its exclusions cover only `__pycache__`, paths containing `.cache`, and `data/auto_evolution`. The function does not anchor packaging to the installed Skill directory and does not exclude common sensitive content such as `.env` files, credentials, private keys, source-control metadata, unrelated projects, generated models, or backup files. Its effective read scope therefore depends on the directory from which the process was launched rather than the files legitimately required by the Skill. The generated archive remains local under `/tmp`; no automatic upload or network transmission of the archive was found. The primary risk arises when a user subsequently publishes, transfers, or uploads the archive as the generated Skill release. ### Attack Path 1. The evolution cycle is launched from a directory containing the Skill together with secrets or unrelated files. 2. `generate_zip()` assigns that current directory to `base`. 3. ...[truncated 901 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (77)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The tuner directly rewrites predictor/core.py using regex-based source modification, enabling code changes from runtime data paths. In the context of a sports prediction skill, self-modifying application code is unjustified and highly dangerous because compromised inputs, logic bugs, or unauthorized invocation could permanently alter the skill's behavior or introduce backdoors into future runs.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This variant ties the mismatch to a primary backtest-validation purpose instead of the declared user-facing prediction workflow. When a skill presents itself as end-user analytics but actually centers on internal validation or automation, users may unknowingly run code paths involving broader file/network activity than expected, which raises trust-boundary and review-evasion concerns.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file contains a self-directed 'evolution' workflow that fetches data, evaluates behavior, logs version history, and repackages the skill into a new distributable ZIP. That materially exceeds the declared sports-prediction purpose and creates an unauthorized self-modification/supply-chain capability, which is dangerous because it can be used to alter and redistribute the skill outside normal review controls.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The ZIP generation walks the entire project tree and packages nearly all files, only excluding a few paths. In a skill whose stated function is match prediction and betting-strategy generation, broad packaging is unnecessary and risks unintended redistribution of source, secrets, internal metadata, or future-added sensitive files, making it a supply-chain and data-exposure issue.
- Content
Static analysis
No suspicious patterns detected.