数黑棋子

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:59 AM UTC
• Version: 0.1.5

Overview

This is a local Go-board image counting skill with disclosed dependency installation and no hidden data access, network use, or persistence.

Use this skill in a dedicated virtual environment or container, preferably with pinned and hash-locked dependency versions. Only process images you intend to analyze as Go boards, and review the generated overlay when the board is blurry, cropped, obstructed, or contains unsettled dead stones.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Allow Unreviewed Package Updates

Content

View full analysis

Vulnerability Details

File Locations:

• scripts/requirements.txt:1-3
• SKILL.md:30-34
• README.en.md:17-23
• README.md:17-23

Vulnerability Type: Supply-chain risk caused by unconstrained dependency resolution
Risk Level: Medium

Vulnerable Code

scripts/requirements.txt:1-3:

text

numpy>=1.26
opencv-python-headless>=4.8
pillow>=10

SKILL.md:30-34:

bash

Install script dependencies only if they are missing:

python3 -m pip install -r /path/to/count-go-black-stones/scripts/requirements.txt

README.en.md:17-23:

bash

## Install Dependencies

Install only when dependencies are missing:

python3 -m pip install -r scripts/requirements.txt

README.md:17-23:

bash

## 安装依赖

只在缺少依赖时安装：

python3 -m pip install -r scripts/requirements.txt

Technical Analysis

All three dependencies use minimum-version constraints without upper bounds, exact version pins, or artifact hashes. Consequently, pip resolves and installs the newest package release that satisfies each constraint at installation time. The effective dependency set can therefore change after the Skill has been reviewed.

The package names are established public packages, and the audit found no evidence that their currently published releases are malicious. Nevertheless, the installation procedure does not cryptographically bind installation to reviewed artifacts. If an upstream account, package release, package-index response, or transitive dependency is compromised, a later installation can retrieve code that was never included in this repository or assessed during this audit.

Attack Path

1. An attacker compromises an upstream dependency release channel, publishing account, distribution artifact, or relevant transitive dependency.
2. A user follows the documented installation command.
3. pip resolves the latest versions satisfying the unrestricted lower-bound ...[truncated 1294 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace lower-bound-only constraints with exact versions that have been reviewed and tested:

   text

   numpy==<reviewed-version>
   opencv-python-headless==<reviewed-version>
   pillow==<reviewed-version>
   

2. Generate a lock file containing SHA-256 hashes for every direct and transitive distribution artifact.

3. Require hash verification during installation:

   bash

   python3 -m pip install --require-hashes -r scripts/requirements.lock
   

4. Prefer prebuilt wheels from an explicitly configured trusted index, and reject unexpected source distributions where operationally feasible.

5. Install dependencies inside a dedicated, non-privileged virtual environment or container rather than a shared or system-wide Python environment.

6. Introduce a reviewed dependency-update process with automated vulnerability scanning, compatibility tests, and deliberate lock-file regeneration.

7. Document the locked installation command in SKILL.md and both README files so users do not bypass the protected dependency set.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that the default listing 'should be Chinese' for display name, description, and default prompt. This imposes a specific language default as an organizational behavior without indicating user choice or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

L10 将“数子”“形势如何”等自然语言问题作为适用场景，但没有进一步限定必须是围棋棋盘识别/围棋计分语境。“形势如何”尤其常见于泛化对话，缺少排除条件或更具体的触发范围，容易造成技能被非目标请求误调用。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L77 规定“默认使用中文展示名称、中文描述和中文默认提示”，属于自然语言层面的语言/地区策略约束。文件虽提供英文 README 链接，但未说明运行时是否允许用户选择语言或仅限中文用户场景，因此存在语言政策上的强制默认风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest's default prompt describes invoking the skill via a natural-language instruction to count black stones from a Go board photo, but it does not define explicit trigger boundaries, exclusions, or narrow activation context. In a manifest file, this lack of specificity can make it unclear when the skill should activate versus when a general image-analysis request should not map to this skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script hard-codes Chinese-language result values ("胜"/"负") and related Chinese-labeled keys, and these are surfaced in JSON and human-readable output without any opt-in or locale selection. This creates a language/locale policy concern because the skill forces a specific language rather than offering a user choice or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The file presents the skill interface in Chinese while the referenced explanatory documentation is labeled as English only, and there is no indication that users can choose their preferred language. This may create a language-policy concern if the skill experience or required instructions are effectively constrained to a specific language without opt-in.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The dependency is specified with a lower bound only, so builds may resolve to different versions over time, including releases with undiscovered or newly disclosed flaws. This weakens reproducibility and makes it difficult to verify that a safe version of NumPy is consistently installed.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

numpy>=1.26
opencv-python-headless>=4.8
pillow>=10

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

NumPy has known historical advisories, and because the manifest does not pin an exact version, it is impossible to confirm from this file alone whether deployment will select an affected release. The danger is primarily unverifiable exposure rather than proof of an active vulnerable version.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Using an unpinned OpenCV package allows the installed version to vary by environment and time, which can unexpectedly introduce vulnerable or incompatible builds. For an image-processing skill that handles user-supplied board photos, dependency drift increases supply-chain and patch-verification risk.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

numpy>=1.26
opencv-python-headless>=4.8
pillow>=10

Unverifiable Dependency: opencv-python-headless has 16 known advisory(ies) (CVE-2019-14493 (NULL Pointer Dereference in OpenCV.); CVE-2019-9423 (Out-of-bounds Write in OpenCV); CVE-2019-14491 (Out-of-bounds Read in OpenCV) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

OpenCV has had multiple memory-safety issues, and this skill's purpose involves processing attacker-controlled image inputs. Without version pinning, the runtime could resolve to an affected build, making the image-processing context more dangerous than a non-input-facing package.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

Pillow is also declared with only a minimum version, so installations are not reproducible and may resolve to unsafe versions in some environments. Because this skill processes images from users, uncertainty around the exact image library version is a meaningful security concern even if the manifest itself is not directly exploitable.

Content

Scanner excerpt · scripts/requirements.txt (reported line 3)May include surrounding context.

text

numpy>=1.26
opencv-python-headless>=4.8
pillow>=10

Unverifiable Dependency: pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Pillow has a history of vulnerabilities including issues triggered by crafted image files, and this skill explicitly consumes user-provided photos. Since the manifest does not pin a safe version, there is real uncertainty about whether deployment could include an exploitable build.

Content

No source excerpt is available for this finding.