MLOps Automation

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:23 PM UTC
• Version: 1.0.0

Overview

This skill is a small MLOps template package; its CI examples use external services and mutable dependencies, but the behavior is visible and aligned with its stated purpose.

Before installing or copying this skill into a repository, review the CI workflow: pin GitHub Actions and Python build dependencies, decide whether Codecov upload is acceptable for your project, and add least-privilege workflow permissions. The package appears benign, but its templates need normal CI supply-chain hardening before use in sensitive repositories.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: references/ci-workflow.yml:16

Finding

GitHub Actions Referenced by Mutable Version Tags

Content

View full analysis

Vulnerability Details

File Location: references/ci-workflow.yml, lines 16-43
Vulnerability Type: CI/CD supply-chain exposure through mutable action references
Risk Level: Medium

Vulnerable Code

yaml

    steps:
      - uses: actions/checkout@v4

      - name: Install uv
        uses: astral-sh/setup-uv@v4
        with:
          enable-cache: true

      - name: Set up Python ${{ matrix.python-version }}
        uses: actions/setup-python@v5
        with:
          python-version: ${{ matrix.python-version }}

      - name: Install dependencies
        run: uv sync --all-extras --dev

      - name: Run linters
        run: |
          uv run ruff check src/ tests/
          uv run ruff format --check src/ tests/
          uv run mypy src/

      - name: Run tests
        run: uv run pytest tests/ -v --cov=src --cov-report=xml

      - name: Upload coverage
        uses: codecov/codecov-action@v4
        if: matrix.python-version == '3.11'
        with:
          file: ./coverage.xml

Technical Analysis

The workflow references actions/checkout, astral-sh/setup-uv, actions/setup-python, and codecov/codecov-action using mutable major-version tags. Unlike full commit hashes, tags can be moved or replaced by the upstream repository. Consequently, the code executed by a future workflow run may differ from the code originally reviewed.

GitHub Actions execute code on the CI runner. If an upstream action repository or release process is compromised and one of these tags is redirected to malicious code, the altered action would execute automatically during subsequent workflow runs.

Attack Path

1. An attacker compromises an upstream action repository, maintainer account, release process, or tag-management mechanism.
2. The attacker moves a referenced major-version tag, such as v4 or v5, to a malicious commit.
3. A push or pull request triggers this ...[truncated 880 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every third-party action to a reviewed, immutable full commit SHA rather than a mutable tag.

• Retain the release version in a comment for maintainability, for example:

  yaml

  - uses: actions/checkout@REVIEWED_FULL_COMMIT_SHA # v4
  

• Review action updates before changing pinned hashes, using an automated dependency update service where appropriate.

• Explicitly configure least-privilege workflow permissions, such as:

  yaml

  permissions:
    contents: read
  

• Grant additional permissions only to the individual jobs that require them.

• Avoid exposing secrets to untrusted pull-request workflows and use protected environments for privileged operations.

• Audit all transitive action dependencies and prefer actions maintained by trusted publishers.

T08 · Insecure Dependencies

Warning

• Location: references/ci-workflow.yml:50

Finding

Unpinned Python Build Tool Installed During CI

Content

View full analysis

Vulnerability Details

File Location: references/ci-workflow.yml, lines 50-54
Vulnerability Type: Unpinned package installation in a privileged build pipeline
Risk Level: Medium

Vulnerable Code

yaml

    steps:
      - uses: actions/checkout@v4

      - name: Build package
        run: |
          pip install build
          python -m build

Technical Analysis

The command pip install build resolves and installs the current release of the build package and its dependencies at workflow runtime. No exact version, lock file, package hash, or trusted artifact constraint is specified. This makes CI behavior dependent on package-index state rather than a reviewed dependency set.

Python package installation can execute package build hooks and installs code that is immediately invoked by python -m build. If the selected package release, a transitive dependency, or the package distribution channel is compromised, attacker-controlled code could execute on the CI runner. The absence of integrity hashes also prevents the workflow from verifying that downloaded artifacts match previously reviewed files.

Attack Path

1. An attacker compromises the relevant package publisher, package-index account, release process, or a transitive dependency.
2. A malicious or compromised release becomes the version selected by the unconstrained pip install build command.
3. A push to the main branch triggers the build job after the check job completes.
4. The runner downloads and installs the attacker-controlled package or dependency.
5. Malicious code executes during installation or when python -m build runs.
6. The attacker can inspect repository data available on the runner, alter package output, modify the Docker build context, or access credentials available to the job within their configured permissions.

Impact Assessment

Exploitation could result in arbitrary code execution on the CI r ...[truncated 321 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the build tool and all transitive dependencies to reviewed versions through a lock file or constraints file.

• Require cryptographic hashes for downloaded distributions, for example by using a generated requirements file with --require-hashes.

• Install dependencies only from approved package indexes and disable unintended fallback indexes.

• Cache only artifacts whose identities and integrity have been validated.

• Run build jobs with explicit least-privilege permissions:

  yaml

  permissions:
    contents: read
  

• Generate software bills of materials and provenance attestations for release artifacts where applicable.

• Use automated dependency updates that open reviewed pull requests rather than resolving unrestricted package versions during every CI run.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence

Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest name includes the suffix "-cn", which suggests a China-specific locale or regional variant. In this file there is no accompanying explanation, opt-in language, or justification that the skill is intended only for a China-specific context, so it may violate the policy against forcing a locale without user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This YAML workflow triggers a network transfer by sending coverage data via the Codecov action, but the file contains no comment or other disclosure indicating that build artifacts or repository metadata are transmitted to an external service. For code/automation files, outbound data transmission should have some visible warning unless it is explicitly documented as part of the skill's stated purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.