Neomano Astro Events (Local Sky + ISS)

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 6:27 AM UTC
• Version: 0.1.0

Overview

This astronomy helper is purpose-aligned and disclosed, with manageable risks from network-downloaded astronomy data and unpinned Python dependencies.

Install only if you are comfortable letting the setup download Python packages and letting runs fetch public astronomy datasets from the network. For stricter environments, pin dependencies and consider adding a local-cache or no-ISS/offline mode before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/bootstrap_venv.py:21

Finding

Unpinned Third-Party Dependencies Allow Supply-Chain Drift

Content

View full analysis

Vulnerability Details

File Location: scripts/bootstrap_venv.py, lines 21–22
Vulnerability Type: Unpinned network-fetched dependencies
Risk Level: Medium

Vulnerable Code

python

run([py, "-m", "pip", "install", "--upgrade", "pip"])
run([py, "-m", "pip", "install", "skyfield", "pytz"])

Technical Analysis

The bootstrap process upgrades pip and installs skyfield and pytz from the configured Python package index without exact version constraints, integrity hashes, or a reviewed lock file. Consequently, the code installed and executed can change after this Skill has been audited.

Python packages may execute code during installation and are subsequently imported by scripts/events.py. If the package repository, configured package-index source, maintainer account, or a future dependency release is compromised, the bootstrap process can install attacker-controlled code. This is a supply-chain weakness rather than evidence that the currently named packages are malicious.

The subprocess invocation itself uses an argument array without shell=True; no shell-command injection was identified in this code.

Attack Path

1. An attacker compromises a dependency release, its publisher account, the configured package index, or another component in the transitive dependency chain.
2. The attacker publishes a malicious version that still satisfies the unconstrained installation request.
3. A user follows the setup instructions and runs scripts/bootstrap_venv.py.
4. The bootstrap script downloads and installs the mutable package version into .venv.
5. Malicious installation logic executes immediately, or malicious runtime logic executes when scripts/events.py imports the installed package.
6. The payload runs with the permissions and environment access of the user who invoked the bootstrap or Skill.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the invoking user's privileges. Depending ...[truncated 496 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin exact versions of pip, skyfield, pytz, and all transitive dependencies in a reviewed lock file.
2. Record cryptographic hashes for every distribution and install with pip install --require-hashes -r requirements.txt.
3. Avoid an unconditional pip --upgrade operation. If a specific pip version is required, pin and hash that version as well.
4. Generate dependency locks in a controlled environment and review changes before updating them.
5. Use a trusted, explicitly configured package index and restrict unexpected alternate or extra indexes.
6. Add automated dependency vulnerability and provenance checks to the release process.
7. Consider distributing or caching reviewed wheels from a controlled repository so installation does not resolve mutable dependency versions at runtime.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/bootstrap_venv.py (reported line 14)May include surrounding context.

python

def run(cmd):
    print("+", " ".join(cmd))
    subprocess.check_call(cmd)


def main():

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module documentation says the tool reports local astronomy events, but the implementation also retrieves ISS TLE data from an external URL. This undisclosed network behavior can violate caller expectations, create privacy and reliability concerns, and expand the trust boundary by introducing third-party data into an otherwise local-seeming utility.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run.py (reported line 15)May include surrounding context.

python

target = base / "scripts" / "events.py"
    cmd = [str(vpy), str(target), *sys.argv[1:]]
    print("+", " ".join(cmd))
    return subprocess.call(cmd)


if __name__ == "__main__":

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code performs a network request to fetch ISS orbital elements without warning the user or providing a way to disable it. In a skill or automation context, silent outbound requests may leak usage metadata, fail unpredictably in restricted environments, or surprise operators who expect purely local execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.