Generating Evaluation Rubrics

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 0.1.0

Overview

This rubric-generation skill has a clear educational purpose, but it asks the agent to install a mutable Python dependency and run referenced local files that are not included in the artifact.

Review before installing. The core task is understandable and not malicious, but the package is incomplete for its advertised Excel generation and may prompt the agent to install packages or run a relative script path. Prefer a version that bundles the script and examples, pins dependencies, and asks clearly before modifying the local Python environment or writing files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:173

Finding

Unpinned Runtime Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:173
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

- **openpyxl 未安装**：先执行 `pip install openpyxl>=3.0.0` 安装依赖，再重试脚本。告知用户在安装依赖。

English translation: If openpyxl is not installed, execute pip install openpyxl>=3.0.0 before retrying the script.

Technical Analysis

The skill instructs the agent to install a third-party Python package at runtime using an open-ended version constraint. The command does not specify an exact reviewed version, cryptographic hashes, a lockfile, an isolated environment, or an explicitly trusted package index.

Consequently, the installed artifact can vary over time. Package installation also executes package build and installation machinery, making dependency retrieval part of the effective execution path. This creates supply-chain exposure if a future compatible release, transitive dependency, configured package index, or intercepted repository response is compromised.

The audit found no evidence that openpyxl itself is malicious. The issue is the unsafe dependency acquisition policy.

Attack Path

1. A user requests generation of an Excel rubric.

2. The environment does not already contain openpyxl.

3. Following SKILL.md, the agent executes:

   bash

   pip install openpyxl>=3.0.0
   

4. pip resolves a mutable package version and any required dependencies from its configured index.

5. If the selected artifact or package source has been compromised, attacker-controlled installation or runtime code executes with the privileges of the agent process.

6. The compromised component can then affect Excel generation and access resources available to that process.

This path depends on a compromised dependency or package source; no such compromise was demonstrated in the audited artifact.

Impact Assessment

Successful exploitation could execute arbitrary Python code with the sa ...[truncated 266 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin openpyxl to an exact, reviewed version rather than using >=3.0.0.
2. Maintain a lockfile containing cryptographic hashes and install with hash verification, such as pip install --require-hashes.
3. Install dependencies inside a dedicated virtual environment with minimal permissions.
4. Configure an explicit trusted package index instead of relying on ambient pip configuration.
5. Review and pin transitive dependencies where applicable.
6. Prefer bundling a reproducibly built, audited dependency environment.
7. Require explicit user approval before modifying the runtime environment.
8. Document failure behavior that does not silently install packages, such as returning setup instructions or producing the documented CSV fallback.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to 'complete read' references/examples.md with no scope limits creates an unnecessary broad file-read capability before responding. If that reference file contains unrelated prompt text, secrets, or embedded adversarial instructions, the model may ingest and reflect sensitive repository content or become influenced by untrusted data during the calibration step.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown skill instructs the agent to save rubric data as a JSON file and create an XLSX file, defaulting to the current working directory if the user does not specify a path. Although there is a confirmation step before generation, the description does not explicitly warn the user that local files will be created and where they may be stored.

Content

No source excerpt is available for this finding.