Terrain Route Video

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:48 PM UTC
• Version: 0.2.0

Overview

This skill appears to do what it advertises: generate route videos using disclosed map services, local files, and FFmpeg, with normal dependency and route-privacy caveats.

Install it in a fresh virtual environment, be aware that route coordinates may be sent to public routing and map-tile services, and prefer pinned dependencies if you need reproducible or higher-assurance installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:49
• Finding: Unpinned Third-Party Python Dependencies## Vulnerability Details **File Location**: `SKILL.md`, lines 49–52 **Vulnerability Type**: Unpinned third-party dependencies and missing integrity verification **Risk Level**: Medium ### Vulnerable Code ```bash python3 -m venv .venv source .venv/bin/activate pip install -U pip pip install numpy matplotlib pillow requests ``` ### Technical Analysis The installation instructions retrieve the latest available versions of `numpy`, `matplotlib`, `pillow`, and `requests` without version constraints or cryptographic hashes. They also upgrade `pip` without pinning or integrity verification. Because dependency resolution is not reproducible, future executions may install dependency versions that were not reviewed with the Skill. If an upstream package or release channel is compromised, following the documented runbook could install attacker-controlled package code. Python packages may execute code during installation or when imported by `scripts/terrain_route_video.py`. This is a supply-chain weakness rather than evidence that any currently named dependency is malicious. ### Attack Path 1. An attacker compromises an upstream package account, distribution artifact, or package-delivery channel for one of the unpinned dependencies. 2. The attacker publishes or substitutes a malicious release that satisfies the unrestricted package name. 3. A user follows the Skill's documented installation instructions. 4. `pip` resolves and downloads the attacker-controlled release because no approved version or hash is enforced. 5. Malicious code executes during installation or when the route-video script imports the affected package. ### Impact Assessment Malicious dependency code would execute with the privileges of the user running `pip` or the Skill. Depending on those privileges, it could access that user's files and environment variables, alter generated artifacts, make arbitrary network requests, or execute additional local commands. The reviewed Skill does not itself r ...[truncated 130 chars]
• Remediation: ## Remediation Suggestions 1. Create a reviewed lock file containing exact versions for all direct and transitive dependencies. 2. Record SHA-256 hashes for every permitted distribution and install with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Pin the packaging toolchain instead of using an unrestricted `pip install -U pip`. 4. Generate locks separately for supported Python versions and operating systems when platform-specific wheels differ. 5. Periodically scan and deliberately update locked dependencies after reviewing security advisories and compatibility. 6. Use a trusted package index explicitly where deployment policy requires it, and preserve provenance information for approved artifacts.

SkillSpector

Vulnerability Patterns

• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the user to create files, install Python packages, make network requests to OSRM and map tile servers, and invoke local shell commands, but it does not declare any explicit tool scope or permissions. This creates an authorization and transparency gap: an agent may execute file, network, and shell operations beyond what a reviewer or runtime policy expects, increasing the chance of unintended external access or local command execution.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code renders fixed Chinese text in the generated video for the mode label, which forces a specific locale in user-visible output. The file does not provide a language selection mechanism or document that the skill is intentionally restricted to a Chinese-language context.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

str(out_path),
    ]
    print("Encoding video...")
    subprocess.check_call(cmd)
    print("Done:", out_path)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Static analysis

No suspicious patterns detected.