Terrain Route Video

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 0.2.0

Overview

This skill appears to do what it advertises: generate route videos using disclosed map services, local files, and FFmpeg, with normal dependency and route-privacy caveats.

Install it in a fresh virtual environment, be aware that route coordinates may be sent to public routing and map-tile services, and prefer pinned dependencies if you need reproducible or higher-assurance installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 49–52
Vulnerability Type: Unpinned third-party dependencies and missing integrity verification
Risk Level: Medium

Vulnerable Code

bash

python3 -m venv .venv
source .venv/bin/activate
pip install -U pip
pip install numpy matplotlib pillow requests

Technical Analysis

The installation instructions retrieve the latest available versions of numpy, matplotlib, pillow, and requests without version constraints or cryptographic hashes. They also upgrade pip without pinning or integrity verification.

Because dependency resolution is not reproducible, future executions may install dependency versions that were not reviewed with the Skill. If an upstream package or release channel is compromised, following the documented runbook could install attacker-controlled package code. Python packages may execute code during installation or when imported by scripts/terrain_route_video.py.

This is a supply-chain weakness rather than evidence that any currently named dependency is malicious.

Attack Path

1. An attacker compromises an upstream package account, distribution artifact, or package-delivery channel for one of the unpinned dependencies.
2. The attacker publishes or substitutes a malicious release that satisfies the unrestricted package name.
3. A user follows the Skill's documented installation instructions.
4. pip resolves and downloads the attacker-controlled release because no approved version or hash is enforced.
5. Malicious code executes during installation or when the route-video script imports the affected package.

Impact Assessment

Malicious dependency code would execute with the privileges of the user running pip or the Skill. Depending on those privileges, it could access that user's files and environment variables, alter generated artifacts, make arbitrary network requests, or execute additional local commands. The reviewed Skill does not itself r ...[truncated 130 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed lock file containing exact versions for all direct and transitive dependencies.
2. Record SHA-256 hashes for every permitted distribution and install with hash enforcement:

bash

python3 -m pip install --require-hashes -r requirements.txt

3. Pin the packaging toolchain instead of using an unrestricted pip install -U pip.
4. Generate locks separately for supported Python versions and operating systems when platform-specific wheels differ.
5. Periodically scan and deliberately update locked dependencies after reviewing security advisories and compatibility.
6. Use a trusted package index explicitly where deployment policy requires it, and preserve provenance information for approved artifacts.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill instructs the user to create files, install Python packages, make network requests to OSRM and map tile servers, and invoke local shell commands, but it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may execute file, network, and shell operations beyond what a reviewer or runtime policy expects, increasing the chance of unintended external access or local command execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code renders fixed Chinese text in the generated video for the mode label, which forces a specific locale in user-visible output. The file does not provide a language selection mechanism or document that the skill is intentionally restricted to a Chinese-language context.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/terrain_route_video.py (reported line 730)May include surrounding context.

python

str(out_path),
    ]
    print("Encoding video...")
    subprocess.check_call(cmd)
    print("Done:", out_path)

Static analysis

No suspicious patterns detected.