MLOps Project Initialization

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:38 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward MLOps project initializer, but users should review the target path and avoid blindly running the suggested network-to-shell uv installer.

Install only if you want a local project scaffolding helper. Run it from a safe workspace with a new project name, review the generated files before committing further work, and install uv through a trusted verified method instead of blindly piping a downloaded script into sh.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/init-project.sh:15

Finding

Unverified Remote Installer Executed Through a Shell Pipeline

Content

View full analysis

Vulnerability Details

File Location: scripts/init-project.sh, line 15
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

command -v uv >/dev/null 2>&1 || { echo "❌ uv not installed. Run: curl -LsSf https://astral.sh/uv/install.sh | sh"; exit 1; }

Technical Analysis

When uv is unavailable, the script instructs the user to download a live installer from https://astral.sh/uv/install.sh and pipe it directly into sh. The project does not pin an installer version or immutable artifact, validate a cryptographic checksum or signature, or provide an opportunity to inspect the downloaded script before execution.

The command is printed as installation guidance rather than executed automatically. Nevertheless, following the documented instruction creates a remote code-execution channel whose effective payload can change after this Skill has been audited. Although the named domain is associated with the expected tool vendor, domain reputation alone does not provide artifact integrity or immutability.

This behavior is not necessary to initialize the project. The script can safely fail with ordinary installation documentation, or direct users to a package manager or a separately downloaded and cryptographically verified release artifact.

Attack Path

1. A user invokes scripts/init-project.sh on a system where uv is not installed.
2. The script prints the curl ... | sh installation command and exits.
3. The user follows that instruction.
4. curl retrieves the installer currently served by the external endpoint.
5. sh executes the response immediately without local inspection or integrity verification.
6. If the publication infrastructure, endpoint, DNS/TLS path, or installer content is compromised, attacker-controlled commands execute with the invoking user's permissions.

Impact Assessment

A malicious remote response could execute arbitrary commands wi ...[truncated 394 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct network-to-shell recommendation.
2. Prefer installation through a trusted operating-system package manager with explicit package and version guidance.
3. If an upstream release artifact must be used, pin a specific version and immutable release URL.
4. Download the artifact to a local file instead of piping it directly into a shell.
5. Verify the artifact using a vendor-published cryptographic signature or pinned SHA-256 checksum before execution.
6. Present the downloaded script for inspection and execute it only after successful verification and explicit user consent.
7. Clearly state that elevated privileges are unnecessary unless a particular, documented installation method explicitly requires them.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 67)May include surrounding context.

sh

*~

# Environment
.env
.env.local

# Data & Models (use DVC/LFS if needed)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/init-project.sh (reported line 68)May include surrounding context.

sh

# Environment
.env
.env.local

# Data & Models (use DVC/LFS if needed)
data/

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises shell-based project initialization and file-copy behavior, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, this weakens execution boundaries and can allow the skill to invoke filesystem-modifying shell actions without clear user-visible constraints, increasing the chance of unintended repository creation or writes in the wrong path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file begins with a Chinese heading at L01, but the substantive usage instructions at L03 and below are in English. This imposes mixed-language presentation without stating a supported language preference or giving users an opt-in choice, which can conflict with language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 74% confidence

Finding

The skill is named with a '-cn' suffix and presents its main heading in Chinese, while the actionable instructions are in English. This can imply a language/locale expectation without explicitly giving the user an opt-in choice or explaining the intended audience, which may violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown instructs users to run an initialization script and copy configuration files, but it does not clearly warn that these actions create directories, write files, and initialize a Git repository in the target location. In agent-assisted use, omission of these side effects can lead to accidental modification of the current workspace or an unintended parent directory.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: loguru has 2 known advisory(ies) (CVE-2022-0338 (loguru logs sensitive information); CVE-2022-0338 (Improper Privilege Management in Conda loguru prior to 0.5.3.)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: pytest has 2 known advisory(ies) (CVE-2025-71176 (pytest has vulnerable tmpdir handling); CVE-2025-71176 (pytest has vulnerable tmpdir handling)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 15% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/init-project.sh (reported line 15)May include surrounding context.

sh

cd "$PROJECT_NAME"

# Check tools
command -v uv >/dev/null 2>&1 || { echo "❌ uv not installed. Run: curl -LsSf https://astral.sh/uv/install.sh | sh"; exit 1; }
command -v git >/dev/null 2>&1 || { echo "❌ git not installed"; exit 1; }

# Initialize with uv