MLOps Project Initialization

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward MLOps project initializer, but users should review the target path and avoid blindly running the suggested network-to-shell uv installer.

Install only if you want a local project scaffolding helper. Run it from a safe workspace with a new project name, review the generated files before committing further work, and install uv through a trusted verified method instead of blindly piping a downloaded script into sh.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/init-project.sh:15
• Finding: Unverified Remote Installer Executed Through a Shell Pipeline## Vulnerability Details **File Location**: `scripts/init-project.sh`, line 15 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ```bash command -v uv >/dev/null 2>&1 || { echo "❌ uv not installed. Run: curl -LsSf https://astral.sh/uv/install.sh | sh"; exit 1; } ``` ### Technical Analysis When `uv` is unavailable, the script instructs the user to download a live installer from `https://astral.sh/uv/install.sh` and pipe it directly into `sh`. The project does not pin an installer version or immutable artifact, validate a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded script before execution. The command is printed as installation guidance rather than executed automatically. Nevertheless, following the documented instruction creates a remote code-execution channel whose effective payload can change after this Skill has been audited. Although the named domain is associated with the expected tool vendor, domain reputation alone does not provide artifact integrity or immutability. This behavior is not necessary to initialize the project. The script can safely fail with ordinary installation documentation, or direct users to a package manager or a separately downloaded and cryptographically verified release artifact. ### Attack Path 1. A user invokes `scripts/init-project.sh` on a system where `uv` is not installed. 2. The script prints the `curl ... | sh` installation command and exits. 3. The user follows that instruction. 4. `curl` retrieves the installer currently served by the external endpoint. 5. `sh` executes the response immediately without local inspection or integrity verification. 6. If the publication infrastructure, endpoint, DNS/TLS path, or installer content is compromised, attacker-controlled commands execute with the invoking user's permissions. ### Impact Assessment A malicious remote response could execute arbitrary commands wi ...[truncated 394 chars]
• Remediation: ## Remediation Suggestions 1. Remove the direct network-to-shell recommendation. 2. Prefer installation through a trusted operating-system package manager with explicit package and version guidance. 3. If an upstream release artifact must be used, pin a specific version and immutable release URL. 4. Download the artifact to a local file instead of piping it directly into a shell. 5. Verify the artifact using a vendor-published cryptographic signature or pinned SHA-256 checksum before execution. 6. Present the downloaded script for inspection and execute it only after successful verification and explicit user consent. 7. Clearly state that elevated privileges are unnecessary unless a particular, documented installation method explicitly requires them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Credential Access

High

• Category: Privilege Escalation

Content

*~

# Environment
.env
.env.local

# Data & Models (use DVC/LFS if needed)

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Environment
.env
.env.local

# Data & Models (use DVC/LFS if needed)
data/

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill advertises shell-based project initialization and file-copy behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, this weakens execution boundaries and can allow the skill to invoke filesystem-modifying shell actions without clear user-visible constraints, increasing the chance of unintended repository creation or writes in the wrong path.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The file begins with a Chinese heading at L01, but the substantive usage instructions at L03 and below are in English. This imposes mixed-language presentation without stating a supported language preference or giving users an opt-in choice, which can conflict with language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 74% confidence
• Finding: The skill is named with a '-cn' suffix and presents its main heading in Chinese, while the actionable instructions are in English. This can imply a language/locale expectation without explicitly giving the user an opt-in choice or explaining the intended audience, which may violate the language/locale policy criterion.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The markdown instructs users to run an initialization script and copy configuration files, but it does not clearly warn that these actions create directories, write files, and initialize a Git repository in the target location. In agent-assisted use, omission of these side effects can lead to accidental modification of the current workspace or an unintended parent directory.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: loguru has 2 known advisory(ies) (CVE-2022-0338 (loguru logs sensitive information); CVE-2022-0338 (Improper Privilege Management in Conda loguru prior to 0.5.3.)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence
• Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

External Script Fetching

Low

• Category: Supply Chain

Content

cd "$PROJECT_NAME"

# Check tools
command -v uv >/dev/null 2>&1 || { echo "❌ uv not installed. Run: curl -LsSf https://astral.sh/uv/install.sh | sh"; exit 1; }
command -v git >/dev/null 2>&1 || { echo "❌ git not installed"; exit 1; }

# Initialize with uv

• Confidence: 15% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.