Audit Case Rag

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:17 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed local audit-document search tool; its main risks are normal local document-processing and dependency-management risks, not hidden or malicious behavior.

Install only in an isolated virtual environment, index only case folders you intend to process, and keep the output directory private because the manifest, converted PDFs, and joblib index can contain sensitive audit text. Consider pre-provisioning embedding model files for offline use, pinning dependencies with a lockfile, and sandboxing LibreOffice/PDF parsing for untrusted documents.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill instructs users to create a virtual environment, install dependencies, and run a Python script that writes manifests and persistent index files, while no explicit permission model is declared. That mismatch is a real security concern because a user or host may assume the skill is documentation-only, yet it performs filesystem writes and shell-oriented operations, increasing the chance of unintended execution with local file access.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The script claims to be local-first, but TextEmbedding(model_name=...) may trigger model download or external asset initialization if the model is not already present. In an audit/investigation workflow, that can unexpectedly disclose environment metadata or cause sensitive operational use to depend on network access outside the documented behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Local-first audit/investigation RAG (no cloud APIs)
fastembed>=0.3.0
scikit-learn>=1.5.0
pypdf>=4.2.0
pandas>=2.2.0

• Confidence: 88% confidence
• Finding: The dependency is specified with a lower-bound range instead of an exact pinned version, which makes builds non-reproducible and can silently pull in newly released versions with security or compatibility regressions. In a local-first RAG skill that processes case files, supply-chain drift is a real risk even if this file does not itself execute malicious code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Local-first audit/investigation RAG (no cloud APIs)
fastembed>=0.3.0
scikit-learn>=1.5.0
pypdf>=4.2.0
pandas>=2.2.0
openpyxl>=3.1.2

• Confidence: 88% confidence
• Finding: Using scikit-learn with a minimum-version specifier allows future unreviewed versions to be installed, reducing reproducibility and increasing exposure to accidental breaking or vulnerable releases. This is a supply-chain hygiene issue rather than an immediately exploitable code flaw, but it still weakens deployment security.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Local-first audit/investigation RAG (no cloud APIs)
fastembed>=0.3.0
scikit-learn>=1.5.0
pypdf>=4.2.0
pandas>=2.2.0
openpyxl>=3.1.2
pyyaml>=6.0.1

• Confidence: 93% confidence
• Finding: The unpinned pypdf dependency is more concerning in this skill context because the skill is designed to ingest and parse PDFs from audit/investigation case folders, making the parser part of the attack surface. Allowing any version above 4.2.0 can introduce unreviewed parser behavior or newly vulnerable releases into a document-processing pipeline.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

fastembed>=0.3.0
scikit-learn>=1.5.0
pypdf>=4.2.0
pandas>=2.2.0
openpyxl>=3.1.2
pyyaml>=6.0.1
joblib>=1.3.0

• Confidence: 86% confidence
• Finding: The pandas dependency is not pinned, so installations can vary over time and may incorporate unreviewed upstream changes. While this is common in development, it is still a security and reliability weakness because data-processing libraries can introduce vulnerabilities or unsafe parsing behavior in future releases.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

scikit-learn>=1.5.0
pypdf>=4.2.0
pandas>=2.2.0
openpyxl>=3.1.2
pyyaml>=6.0.1
joblib>=1.3.0
numpy>=1.26.0

• Confidence: 86% confidence
• Finding: An unpinned openpyxl dependency means the package resolver may select different versions over time, undermining reproducibility and potentially introducing vulnerable spreadsheet parsing behavior. Because this skill appears to process case-folder artifacts, document-handling libraries should be tightly controlled.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pypdf>=4.2.0
pandas>=2.2.0
openpyxl>=3.1.2
pyyaml>=6.0.1
joblib>=1.3.0
numpy>=1.26.0

• Confidence: 90% confidence
• Finding: PyYAML has a history of security-sensitive usage patterns, and leaving the dependency unpinned increases the risk of installing an unintended version with changed or unsafe behavior. Even if the file does not show YAML loading code, dependency drift in a parsing library is a meaningful supply-chain concern.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.2.0
openpyxl>=3.1.2
pyyaml>=6.0.1
joblib>=1.3.0
numpy>=1.26.0

• Confidence: 84% confidence
• Finding: Joblib is specified as a floating lower-bound dependency, which permits unreviewed versions and non-deterministic builds. This is primarily a supply-chain hygiene issue, with lower direct impact than parser-facing libraries but still a valid security weakness.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openpyxl>=3.1.2
pyyaml>=6.0.1
joblib>=1.3.0
numpy>=1.26.0

• Confidence: 84% confidence
• Finding: NumPy is unpinned, so future installations may vary and introduce unreviewed code into the environment. Although this is generally lower risk than network-exposed flaws, dependency drift still weakens supply-chain control and reproducibility.

Known Vulnerable Dependency: pypdf==4.2.0 — 10 advisory(ies): CVE-2026-48156 (pypdf: Possible long runtimes for zero-only width values in cross-reference stre); CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-) +7 more

Low

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The flagged pypdf version is associated with multiple advisories, including infinite-loop and long-runtime conditions during PDF parsing. In this skill, that is especially relevant because the system is explicitly built to index and query case-folder PDFs, so a malicious or malformed document could trigger denial-of-service, hang processing, or exhaust resources during ingestion.

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.