MLOps Industrialization

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:37 PM UTC
• Version: 1.0.0

Overview

This is a mostly coherent MLOps package scaffold skill, but its generator can write or overwrite files outside the intended package directory if given a crafted package name.

Review before installing or running. Only run the create script with a simple trusted package name, avoid slashes or dot-dot path components, and run it in a clean project because it can overwrite predictable generated files such as features.py, data.py, and train.py.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/create-package.sh:6

Finding

Path Traversal Allows File Creation and Overwrite Outside the Intended Package Directory

Content

View full analysis

"src/$PACKAGE_DIR/domain/features.py" << 'EOF' ``` The same attacker-controlled path is subsequently used as the destination for additional redirections that create `io/data.py` and `application/train.py`. ### Technical Analysis The first command-line argument is treated as a package name and incorporated directly into filesystem paths. The only normalization replaces hyphens with underscores: ```bash PACKAGE_DIR="${PACKAGE_NAME//-/_}" ``` This does not reject absolute paths, forward slashes, backtracking components such as `..`, or other values that are invalid as Python package identifiers. Shell quoting prevents ordinary shell metacharacter expansion, but it does not prevent filesystem path traversal. For example, the argument `../../target` produces paths beginning with: ```text src/../../target/ ``` After path resolution, these paths point outside the intended `src/` directory. The script uses `mkdir -p`, `touch`, and truncating output redirections (`cat >`) on the resulting locations. Existing `features.py`, `data.py`, and `train.py` files at a traversed destination may therefore be replaced without confirmation. This is an exploitable coding flaw rather than evidence that the script intentionally performs malicious activity. ### Attack Path 1. An attacker controls or influe ...[truncated 1434 chars]

Remediation

View remediation

&2 exit 1 fi PACKAGE_DIR="${PACKAGE_NAME//-/_}" ``` 2. **Enforce destination containment.** Resolve both the intended base directory and destination to canonical absolute paths, then verify that the destination remains beneath the base directory before writing any files. 3. **Reject existing destinations by default.** Avoid silently truncating source files: ```bash if [[ -e "src/$PACKAGE_DIR" ]]; then echo "Error: destination already exists." >&2 exit 1 fi ``` 4. **Use no-clobber behavior or explicit overwrite consent.** If regeneration is required, add a deliberate `--force` option rather than overwriting files automatically. 5. **Create the scaffold only after all validation succeeds.** Validate the package name, canonical destination, containment, and collision state before the first `mkdir`, `touch`, or redirection. 6. **Add negative tests.** Verify rejection of values such as `../target`, `../../target`, `/tmp/target`, `name/subdir`, `.`, and `..`, as well as protection against overwriting an existing package. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description suggests a tool whose main purpose is converting prototypes into distributable Python packages. The code instead scaffolds a new package directory structure and populates it with opinionated example modules for data I/O, feature transformation, and training orchestration. It does not perform prototype transformation, packaging, or distribution setup beyond creating a basic src tree, and even instructs the user to manually register CLI in pyproject.toml later. This is a materially different primary purpose, so the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/create-package.sh (reported line 67)May include surrounding context.

sh

def save_data(df: pd.DataFrame, path: Path) -> None:
    """Save data to disk.
    
    Args:
        df: Dataframe to save

Static analysis

No suspicious patterns detected.