PoliBERT Sentiment Analysis

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

This skill appears aimed at political sentiment analysis, but it ships under-disclosed and fragile analysis behavior that users should review before trusting or installing.

Review this before installing if you need dependable political analysis. Treat outputs as experimental, avoid feeding sensitive political research or private files, update vulnerable dependencies, pin and verify the Hugging Face model, and remove or clearly document the Polymarket script before relying on the package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: test_sample.sh:4

Finding

Unchecked Directory Change Allows Execution of an Untrusted Activation Script

Content

View full analysis

Remediation

View remediation

&2 exit 1 fi "$PYTHON" - <<'PY' # Test code PY ``` If activation must be used, verify that the file is a regular file owned by the expected user and located beneath the canonical project directory before sourcing it. Remove the private author-specific absolute path from the distributed script. ]]>

T08 · Insecure Dependencies

Warning

• Location: polibert_sentiment.py:34

Finding

Remote Model Artifacts Are Loaded Without Immutable Revision or Integrity Pinning

Content

View full analysis

Remediation

View remediation

" tokenizer = AutoTokenizer.from_pretrained( MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False, ) model = AutoModelForSequenceClassification.from_pretrained( MODEL_NAME, revision=MODEL_REVISION, trust_remote_code=False, use_safetensors=True, num_labels=3, id2label={0: "SUPPORT", 1: "OPPOSE", 2: "NEUTRAL"}, label2id={"SUPPORT": 0, "OPPOSE": 1, "NEUTRAL": 2}, ) ``` Additional hardening should include: 1. Record and verify cryptographic hashes for all approved artifacts. 2. Prefer `safetensors` and reject legacy pickle-based model files. 3. Mirror approved artifacts into a controlled internal repository for production use. 4. Use `local_files_only=True` after provisioning the approved cache. 5. Apply the same pinning controls in `test_sample.sh`. 6. Document the model revision alongside the Skill version so reviews are reproducible. ]]>

other

Warning

• Location: polibert_sentiment.py:34

Finding

Masked-Language-Model Checkpoint Is Presented as a Validated Sentiment Classifier

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the underlying skill actually performs Polymarket scraping or hardcoded market summarization instead of NLP sentiment analysis, then the documentation is materially deceptive about both data sources and behavior. In a political-analysis context, this is especially dangerous because users may unknowingly feed sensitive text or rely on fabricated analytics outputs, causing incorrect decisions and violating expectations around what data is processed.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

If the underlying skill actually performs Polymarket scraping or hardcoded market summarization instead of NLP sentiment analysis, then the documentation is materially deceptive about both data sources and behavior. In a political-analysis context, this is especially dangerous because users may unknowingly feed sensitive text or rely on fabricated analytics outputs, causing incorrect decisions and violating expectations around what data is processed.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: torch==2.6.0 — 16 advisory(ies): CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2025-3730 (PyTorch Improper Resource Shutdown or Release vulnerability); CVE-2025-2148 (PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The requirements file pins PyTorch to a version flagged by multiple published advisories, including denial-of-service and memory corruption issues. Even though this file does not itself execute code, installing and using a known-vulnerable ML runtime in a skill that processes external data increases the chance of crashes, resource exhaustion, or potentially worse exploitation depending on the vulnerable code paths reached.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: transformers==4.48.0 — 16 advisory(ies): CVE-2026-4372 (HuggingFace transformers vulnerable to remote code execution); CVE-2025-3933 (Transformers is vulnerable to ReDoS attack through its DonutProcessor class); CVE-2025-6921 (Hugging Face Transformers vulnerable to Regular Expression Denial of Service (Re) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill pins transformers to a version associated with numerous advisories, including a reported remote code execution issue and denial-of-service weaknesses. This is especially concerning in a sentiment-analysis skill that may load models, tokenizers, or processors and may ingest external content from Reddit, because attacker-controlled inputs or malicious model artifacts can make vulnerable parsing and loading paths more reachable.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This file materially deviates from the declared skill purpose: instead of political sentiment analysis with Reddit integration, it performs prediction-market lookup and analysis using hardcoded Polymarket candidate data. That mismatch is dangerous because downstream users or agent orchestrators may grant capabilities, trust outputs, or route sensitive political-analysis tasks based on the advertised skill, while actually receiving unrelated market-derived data that could mislead decisions or conceal undeclared functionality.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is written in Chinese from the outset, which effectively constrains usage to a specific language. The file does not offer an alternative language, opt-in, or explain that the skill is intentionally region- or language-specific, so this appears to violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function claims to scrape live Polymarket event pages, but actually returns static pre-scraped data for one specific event and emits manual instructions for other events. This is dangerous because consumers may believe they are getting fresh, complete market data when they are actually receiving stale or partial hardcoded results, which can silently corrupt analytics, automation, or political monitoring workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README encourages Reddit fetching and local file analysis without clearly warning that input files may contain sensitive data and that Reddit collection may have privacy, compliance, or terms-of-service implications. This is a mild but real security/privacy issue because users may process personal or confidential text without informed consent or retention safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code sends the user-provided candidate or query term to Reddit when --reddit is used, but it does not provide an explicit privacy or network-access warning at the point of execution. That can surprise users and disclose sensitive political interests or research topics to a third party, which is especially relevant in a political sentiment tool where queries may reveal affiliations, investigations, or monitoring targets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.