Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.104 uvicorn>=0.24 gradio>=4.13 requests>=2.31
- Confidence
- 94% confidence
- Finding
- fastapi>=0.104
Security audit
Cnyepay
Security checks across malware telemetry and agentic risk
Overview
This skill is a coherent local assistant for YuePay integration help, with dependency hygiene risks but no evidence of hidden data access, exfiltration, persistence, or destructive behavior.
Install only in a controlled local environment, update or pin the Python dependencies to reviewed patched versions, and do not expose the FastAPI or Gradio ports to the public internet without authentication and network controls. Do not paste real merchant private keys or production secrets into the chat unless you fully trust the local model and host environment.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.104 uvicorn>=0.24 gradio>=4.13 requests>=2.31
- Confidence
- 88% confidence
- Finding
- uvicorn>=0.24
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.104 uvicorn>=0.24 gradio>=4.13 requests>=2.31
- Confidence
- 96% confidence
- Finding
- gradio>=4.13
Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
fastapi>=0.104 uvicorn>=0.24 gradio>=4.13 requests>=2.31
- Confidence
- 93% confidence
- Finding
- requests>=2.31
Known Vulnerable Dependency: fastapi==0.104 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )
High
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
- fastapi==0.104
Known Vulnerable Dependency: gradio==4.13 — 10 advisory(ies): GHSA-26jh-r8g2-6fpr (Gradio's dropdown component pre-process step does not limit the values to those ); CVE-2024-47871 (Gradio uses insecure communication between the FRP client and server); CVE-2024-47166 (Gradio has a one-level read path traversal in `/custom_component`) +7 more
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
- gradio==4.13
Known Vulnerable Dependency: requests==2.31 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more
Medium
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
- requests==2.31
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.