Comment Wordcloud

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:06 AM UTC
• Version: 1.0.0

Overview

This skill coherently turns user-provided comment JSON into local word-frequency and word-cloud files, with ordinary file-output and dependency hygiene caveats.

Install in an isolated virtual environment, preferably with pinned versions for jieba, wordcloud, and matplotlib. Run it only on comment JSON files you intend to process, and choose a dedicated output directory because word_freq.json and word_cloud.png may be created or overwritten there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/generate_wordcloud.py:17

Finding

Unpinned Third-Party Dependency Installation Guidance

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/generate_wordcloud.py:17-26
• SKILL.md:41-44
• SKILL.md:62

Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code and Documentation:

scripts/generate_wordcloud.py:17-26

python

# Check dependencies
try:
    import jieba
    from wordcloud import WordCloud
    import matplotlib
    matplotlib.use('Agg')
    import matplotlib.pyplot as plt
except ImportError as e:
    print(f"Error: Required dependencies are missing")
    print(f"Please install: pip install jieba wordcloud matplotlib")
    sys.exit(1)

SKILL.md:41-44

markdown

## Tech Stack

- Python 3.11+
- jieba 0.42.1
- wordcloud 1.9.3
- matplotlib 3.9.0

SKILL.md:62

markdown

1. Need to install Python dependencies: jieba, wordcloud, matplotlib

Technical Analysis

The runtime installation instruction tells users to install dependencies without exact version constraints, package hashes, a lock file, or an explicitly controlled package source:

bash

pip install jieba wordcloud matplotlib

Although SKILL.md lists intended package versions, those versions are not included in the actionable installation command or enforced by a dependency manifest. Pip may therefore install whichever compatible releases and transitive dependencies are currently supplied by the configured package index.

This creates supply-chain exposure to compromised package releases, compromised package-index infrastructure, dependency confusion through untrusted index configuration, and unexpected future dependency changes. Python packages can execute package-controlled code during installation, import, or normal runtime.

No evidence was found that the listed package names are typosquatted or currently malicious. The risk arises from the unsafe and non-reproducible dependency installation process.

Attack Path

1. A ...[truncated 1250 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a reviewed dependency manifest containing exact versions, such as requirements.txt or a generated lock file.

2. Generate and verify cryptographic hashes for every direct and transitive dependency. Install with a command such as:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Replace the unpinned command in scripts/generate_wordcloud.py with guidance that references the reviewed dependency file.

4. Update SKILL.md so the documented installation procedure uses the same locked and hash-verified dependency set.

5. Install packages only from an approved HTTPS package index. Avoid combining public and private indexes in a way that permits dependency-confusion attacks.

6. Perform installation and execution in an isolated virtual environment or restricted container without elevated privileges.

7. Periodically scan, review, and deliberately update dependency pins rather than accepting new releases automatically.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill describes file read and file write behavior but does not declare any explicit tool scope or permissions boundary. This can cause an agent to invoke the skill with broader filesystem access than the user expects, increasing the chance of unintended reads or writes to arbitrary paths provided through parameters.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The whenToUse field is broad enough that an agent may activate the skill in loosely related social-media analysis tasks without clear user intent. Over-broad activation increases the risk of unnecessary file processing and output generation, especially when the skill accepts file paths and writes artifacts to disk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation states that the script will 'Use jieba for Chinese word segmentation,' which imposes a language-specific processing choice. The file does not indicate that this is optional, user-selected, or limited to Chinese-language datasets, creating a locale/language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The usage description explains the analysis flow but does not clearly warn that the skill will create files in the specified output directory. This can surprise users and lead to unintended file creation or overwriting in sensitive locations if output_dir is chosen poorly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The file contains only Chinese-language content and provides no indication of user choice, opt-in, or justification for a Chinese-only locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern applicable to all file types.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The file is entirely a Chinese stop-word list, and the natural-language labels and content indicate the skill is constrained to Chinese language processing. Under the policy, language-specific behavior should either offer user opt-in or clearly document a justified locale constraint; this file contains neither.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.