UAP Release Analyzer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:08 AM UTC
• Version: 1.0.1

Overview

This skill is a local document-analysis tool that creates reports from user-selected UAP/FOIA folders, with manageable dependency and scoping cautions.

Install and run this only on release folders you choose. Prefer a dedicated virtual environment, pin or review dependency versions if you need reproducibility, and approve any persistent edits to the skill's own agency vocabulary or scripts before letting an agent make them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-2
Vulnerability Type: Unconstrained dependency resolution
Risk Level: Medium

Vulnerable Code

text

pdfplumber
pypdf

The installation documentation also instructs users to resolve these unconstrained dependencies directly:

File Location: README.md:32-41

bash

python3 -m pip install -r ~/.openclaw/workspace/skills/uap-release-analyzer/requirements.txt

bash

python3 -m pip install pdfplumber pypdf

Technical Analysis

Neither dependency has a pinned version or an integrity hash, and the project provides no lock file covering transitive dependencies. Consequently, installation resolves whichever package versions the configured Python package index serves at that time. The installed code can therefore differ from the code present when this skill was audited.

Both dependencies execute within the user's Python process. pypdf is imported by scripts/inventory.py, while pdfplumber is imported by scripts/extract_text.py. A compromised upstream release, package-index account, mirror, or transitive dependency could execute arbitrary code when installed or imported.

This is a supply-chain hardening deficiency rather than evidence that the currently named packages are malicious.

Attack Path

1. An attacker compromises an upstream dependency release, one of its transitive dependencies, or a package source trusted by the victim.
2. The attacker publishes a malicious version that still satisfies the unconstrained requirement.
3. A user follows the documented pip install command.
4. pip resolves and installs the attacker-controlled release because no version or hash restriction rejects it.
5. Malicious code executes during installation or when the pipeline imports the dependency.
6. The code runs with the privileges of the user invoking pip or the analysis scripts.

Impact Assessment

Successful exploitation could provide arbitrary code execution ...[truncated 472 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each direct dependency to a reviewed, exact version, for example:

   text

   pdfplumber==<reviewed-version>
   pypdf==<reviewed-version>
   

2. Generate a fully resolved lock file containing exact versions of all transitive dependencies.

3. Record SHA-256 hashes and require verification during installation:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Use a trusted, explicitly configured package index or an internally controlled package mirror.

5. Add automated dependency vulnerability and provenance scanning to the release process.

6. Re-review dependency updates before changing pinned versions, and test document parsing in an isolated environment.

7. Recommend installation and execution in a dedicated virtual environment or sandbox under a non-privileged account.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broader end-to-end skill that inventories documents, extracts text, performs analytics, and generates a final REPORT.md. The supplied code chunk is narrower: it explicitly requires that text extraction has already been done ('run extract_text.py first'), optionally reads a preexisting inventory.csv, and emits analytics artifacts such as top_terms.csv, terms_by_agency.csv, entities.json, per_file_digest.csv, and cross_doc.json. It does include entity and redaction analytics consistent with part of the description, and it is clearly aimed at UAP/UFO/FOIA-style document releases. However, major declared functions—inventory, text extraction, and REPORT.md generation—are absent from this code chunk. That is a material description-behavior mismatch rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to read and write files and invoke shell-based Python scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates a governance gap: an orchestrator may permit broader-than-necessary file and shell access, increasing the chance of unintended filesystem access or execution beyond the release directory.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger guidance is very broad, including vague prompts like asking what's interesting in a directory. Overly permissive activation can cause the skill to run shell/file-processing workflows on unintended paths or data sets, which is risky because this skill is designed to execute local scripts and generate outputs automatically.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/run_all.py (reported line 13)May include surrounding context.

python

def step(name, args):
    print(f"\n=== {name} ===")
    r = subprocess.run([sys.executable, str(HERE / name)] + list(args))
    if r.returncode:
        print(f"{name} failed (rc={r.returncode})", file=sys.stderr)
        sys.exit(r.returncode)

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency pdfplumber is specified without a version pin, which makes builds non-reproducible and can pull in different code over time. This increases supply-chain risk and makes it harder to verify whether known-vulnerable or breaking releases are being installed.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

pdfplumber
pypdf

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency pypdf is also unpinned, creating the same reproducibility and supply-chain integrity problem. Because this skill processes untrusted PDF documents, allowing an unconstrained parser version increases the chance of unexpectedly installing a release with security or stability issues.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

pdfplumber
pypdf

Unverifiable Dependency: pypdf has 16 known advisory(ies) (CVE-2026-84310 (pypdf: Possible long runtimes/large memory usage when retrieving outlines); CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

pypdf has multiple known advisories, and because no version is pinned, there is no way to determine whether the deployed version is affected. In this skill's context, the package is used to parse potentially hostile third-party PDFs, so denial-of-service issues such as excessive memory use or infinite loops are more relevant than they would be in a low-risk environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.