Pattern Miner

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:21 PM UTC
• Version: 2.0.1

Overview

This skill is a local data-file analyzer with disclosed, user-directed file access and no evidence of hidden execution, exfiltration, or system persistence.

Before installing, consider skipping the documented pip install unless a future version actually needs those packages, or install dependencies in an isolated virtual environment with pinned versions. Only run the analyzer on files you intend to inspect, since it prints file structure to the terminal.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29
• Finding: Unpinned Third-Party Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 29–31 **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip install numpy scikit-learn pandas ``` ### Technical Analysis The documented installation command retrieves three third-party packages without exact version constraints, cryptographic hashes, a lockfile, or an explicitly trusted package index. Consequently, package selection depends on mutable repository state and the user's pip configuration. Python package installation may execute package-controlled build or installation logic. If a dependency, transitive dependency, configured index, or future release is compromised, following this command could cause attacker-controlled code to execute. The current `scripts/analyze.py` implementation uses only Python standard-library modules, so these third-party dependencies also appear unnecessary for the audited implementation. This finding identifies supply-chain exposure in the installation instructions. The audit found no evidence that the named packages are currently malicious or compromised. ### Attack Path 1. An attacker compromises a listed package, one of its transitive dependencies, or a package index configured by the user. 2. The compromised component publishes or serves a version that satisfies the unrestricted installation command. 3. A user follows the instructions and runs `pip install numpy scikit-learn pandas`. 4. Pip resolves and downloads the attacker-controlled component. 5. Malicious build or installation logic executes with the privileges of the user running pip, or malicious runtime code executes when the package is imported later. ### Impact Assessment Successful exploitation could execute arbitrary code with the installing user's privileges. Depending on that user's permissions, this could expose user-readable files and credentials, modify files, install persistence, or access network resources. The ...[truncated 157 chars]
• Remediation: ## Remediation Suggestions 1. Remove the dependency installation instruction while `scripts/analyze.py` remains standard-library-only. 2. If future functionality requires these packages, define reviewed dependencies in a lockfile or requirements file using exact versions. 3. Record cryptographic hashes and require their verification during installation, for example: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 4. Generate the lockfile from a controlled environment and review direct and transitive dependencies before release. 5. Use a trusted, explicitly configured package index and prevent fallback to untrusted supplemental indexes. 6. Regularly scan locked dependencies for known vulnerabilities and update them through a controlled review process. 7. Prefer installation in an isolated virtual environment with no administrative privileges.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Session Persistence

Medium

• Category: Rogue Agent

Content

### Configuration

Create a config file at `~/.pattern-miner/config.json`:

```json
{

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.