Hot3d

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 1:29 AM UTC
• Version: 0.1.0

Overview

This skill is a straightforward HOT3D research guide, with the main caveat that it tells users to install and run code from an unpinned external repository.

Install only if you are comfortable running the HOT3D upstream code and dependencies. Prefer a fresh virtual environment or container, avoid running as administrator/root, and consider pinning or reviewing the repository commit and requirements before executing the demo.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:78

Finding

Unpinned Remote Repository and Dependencies Are Executed Locally

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 78–89
Vulnerability Type: Unpinned remote source code and dependency execution
Risk Level: Medium

bash

# Clone repository
git clone https://github.com/facebookresearch/hot3d.git
cd hot3d

# Install dependencies
pip install -r requirements.txt
# Key: PyTorch3D, Open3D, vispy

# Download dataset (requires registration)
# https://facebookresearch.github.io/hot3d/dataset.html

# Run demo
python demo/visualize_tracking.py \
    --sequence demo_sequence \
    --output_dir ./visualizations

Technical Analysis

The documented workflow clones the mutable default branch of an external Git repository without pinning it to a reviewed commit hash or signed release. It then installs packages specified by the remotely supplied requirements.txt and executes a Python script from that repository.

Consequently, the code executed by a user can differ from the content that existed when this Skill was reviewed. Dependency installation may also execute package build or installation logic. The Skill does not provide a lockfile, package hashes, expected commit identifier, signature-verification procedure, or isolated execution requirements.

The repository URL is consistent with the declared official HOT3D project, and the audited file contains no evidence that its authors intentionally redirected users to a malicious source. The risk instead arises from transitive trust in mutable upstream code and its dependency supply chain.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a dependency referenced by its requirements.
2. The attacker modifies the repository's default branch, its requirements.txt, the demonstration script, or a referenced package release.
3. A user follows the Skill instructions and clones the mutable default branch.
4. The user runs `pip install -r requirements.tx ...[truncated 964 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the upstream source to a reviewed full commit hash or a cryptographically verified signed release instead of cloning and executing the mutable default branch.
2. Document the expected repository URL, release tag, commit hash, and signature or checksum verification steps.
3. Replace unconstrained dependency installation with a reviewed lockfile containing exact versions and cryptographic hashes.
4. Install dependencies with hash enforcement, such as pip install --require-hashes -r requirements.lock.
5. Review both the dependency manifest and the demonstration script at the pinned revision before recommending execution.
6. Run installation and demonstration commands inside a dedicated virtual environment, non-privileged container, or sandbox with minimal filesystem and network access.
7. Do not run the workflow as root or with administrator privileges, and avoid exposing unrelated credentials or sensitive host directories to the execution environment.
8. Establish a controlled update process in which new upstream revisions and dependency changes are reviewed before updating the documented pin.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.