Code Refactor For Reproducibility

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:31 AM UTC
• Version: 0.1.0

Overview

The skill is broadly consistent with helping refactor research code for reproducibility, but users should watch for unpinned dependencies and generated files overwriting existing output files.

Install and run this only in an isolated project environment. Review or replace the root requirements.txt before installing dependencies, especially the ambiguous 'src' entry, and use a fresh output directory or a backup because the bundled generator can replace README, requirements, CI, Docker, and source template files under the selected output path.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unnecessary Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

pandas== scipy== ``` 4. Generate and verify hashes for every distribution, then install using: ```bash python -m pip install --require-hashes -r requirements.txt ``` 5. Pin `pipreqs` to a reviewed version if it remains part of the workflow. 6. Use a lock file or a tool such as `pip-tools` to pin transitive dependencies. 7. Perform dependency vulnerability and provenance checks in CI, and update dependencies through a controlled review process. 8. Install dependencies inside an isolated virtual environment using a non-privileged account. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/main.py:1340

Finding

Existing Output Files Are Silently Overwritten

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The shell sequence includes chained commands and a destructive cleanup operation (rm -rf .venv_test). Although targeted at a test virtual environment, chaining creation, activation, package installation, and deletion in one flow increases the risk of unintended deletion or abuse if variables, working directory, or copied adaptations change. In a skill that may be followed semi-automatically, this pattern is more dangerous because users or agents may execute it without carefully validating context.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

python -m venv .venv_test && source .venv_test/bin/activate pip install -r requirements.txt python -c "import pandas, numpy, sklearn" deactivate && rm -rf .venv_test

text

### environment.yml (Conda)

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description says to use the skill when 'adding documentation to existing analysis scripts' or 'preparing code for sharing with collaborators,' which are broad tasks not narrowly tied to this specific reproducibility refactoring workflow. Because no explicit trigger boundaries or negative examples are provided, the skill could be invoked for many ordinary coding requests beyond its intended scope.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring says it will 'refactor' messy scripts into modular, reproducible code suitable for top journals. In practice, the implementation analyzes files, emits templates, and later tells the user to manually copy original functions, which contradicts the claimed automated refactoring behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This Python file contains core natural-language descriptions such as the module docstring and multiple comments in Chinese, with no indication that users may choose another language or that the skill is intended only for a Chinese-speaking context. Under the language/locale policy rule, this is a natural-language policy concern because it constrains comprehension and use without opt-in or justification.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/main.py (reported line 210)May include surrounding context.

python

git clone https://github.com/username/{self.project_name}.git
cd {self.project_name}

# Create environment (conda)
conda env create -f environment.yml
conda activate {self.project_name}

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill presents itself as refactoring existing analysis scripts for reproducibility, yet the generated analysis.py only provides generic helpers and TODO comments. This does not match the stated transformation of the user's original research code into a reusable workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest and module docstring describe transforming messy research scripts into publication-ready, reproducible workflows. However, the generated output is a boilerplate project skeleton, and the tool explicitly instructs the user to manually copy original functions afterward, showing that actual refactoring of source logic is not performed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency list uses an unpinned package name for numpy, so installations may resolve to different versions over time. This weakens reproducibility and can silently introduce vulnerable or incompatible releases through normal dependency resolution or supply-chain changes.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

numpy
pandas
pytest
scipy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Because numpy is not pinned, the manifest does not establish whether the environment will install a vulnerable or patched release. This makes advisory exposure unverifiable and increases supply-chain risk, particularly in a skill explicitly meant to produce reproducible research workflows.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The pandas dependency is unpinned, allowing different environments to install different versions. In a publication and reproducibility-focused skill, this is especially risky because it undermines deterministic builds and makes it impossible to verify whether a safe version is being installed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

numpy
pandas
pytest
scipy
src

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The unpinned pandas dependency prevents validation that an installed version is outside known advisory ranges. While not proof that a vulnerable version will be used, it is still a real security hygiene weakness because exposure cannot be assessed or reproduced reliably.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Pytest is listed without a version constraint, so build or test environments may pull different releases with different behaviors or security properties. Even for a development dependency, this creates supply-chain uncertainty and can affect CI integrity.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

numpy
pandas
pytest
scipy
src

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Pytest has known advisories, and without a pinned version there is no way to confirm whether an affected release will be installed in developer or CI environments. This is less severe than a confirmed vulnerable pin, but it still leaves the testing toolchain unverifiable and potentially exposed.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Scipy is unpinned, which means the installed version is not controlled and may vary by installation time or mirror state. This creates both reproducibility and security verification problems because affected versions cannot be ruled out.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

numpy
pandas
pytest
scipy
src

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The scipy entry is not pinned, so the advisory status of the eventual installed version cannot be verified from the manifest. In a reproducibility-oriented skill, that ambiguity is more dangerous than usual because users may assume the workflow is controlled and publication-ready when it is not.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The entry 'src' is an unpinned local or package reference with ambiguous resolution semantics. Depending on installation context, this can accidentally install from an unintended local path or package source, increasing the risk of dependency confusion or inconsistent builds.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

pandas
pytest
scipy
src

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · scripts/main.py (reported line 296)May include surrounding context.

python

copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/main.py (reported line 1165)May include surrounding context.

python

# Install system dependencies
RUN apt-get update && apt-get install -y \\
    git \\
    && rm -rf /var/lib/apt/lists/*

# Copy requirements first for better caching
COPY requirements.txt .

Tool Parameter Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/main.py (reported line 1165)May include surrounding context.

python

# Install system dependencies
RUN apt-get update && apt-get install -y \\
    git \\
    && rm -rf /var/lib/apt/lists/*

# Copy requirements first for better caching
COPY requirements.txt .

Chaining Abuse

Low

• Category: Tool Misuse
• Confidence: 15% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/main.py (reported line 1165)May include surrounding context.

python

# Install system dependencies
RUN apt-get update && apt-get install -y \\
    git \\
    && rm -rf /var/lib/apt/lists/*

# Copy requirements first for better caching
COPY requirements.txt .

Static analysis

No suspicious patterns detected.