SchemaPin

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:27 PM UTC
• Version: 1.0.0

Overview

This is a coherent documentation skill for using SchemaPin, with ordinary dependency-install guidance but no hidden or destructive behavior in the artifact.

Install in a virtual environment or isolated project, pin schemapin versions for production or CI, and protect generated private keys. Expect the tool to create signature manifests and maintain trust pins as part of its normal verification workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Unpinned PyPI Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install schemapin

Technical Analysis

The installation command does not specify an exact reviewed version, package hash, lockfile, or other integrity constraint. Consequently, it installs whichever release the package index resolves at execution time. The installed artifact is mutable external content and is not included in this repository, so its implementation cannot be validated against the audited documentation.

If the package publisher, maintainer credentials, distribution process, or registry entry is compromised, a malicious release could be delivered through this legitimate-looking command. Malicious Python code could run during a source-package build or when the installed library is imported and used by the documented examples.

Attack Path

1. An attacker compromises the package publisher, release pipeline, or registry entry.
2. The attacker publishes a malicious release under the expected package name.
3. A user or AI agent follows the documented unpinned installation command.
4. The package index resolves the malicious release because no exact version or hash is required.
5. Attacker-controlled code runs during package build or subsequent import.
6. The code accesses resources available to the installation or application process, potentially including SchemaPin private keys.

Impact Assessment

Malicious package code would execute with the privileges of the user or service running the installation or application. It could read accessible files and environment variables, alter project files, make network requests, or compromise cryptographic key material generated or processed by the application. The scope is limited by the host account's permissions but may include CI/CD credentials and signing keys when i ...[truncated 53 chars]

Remediation

View remediation

Remediation Suggestions

• Pin schemapin to an exact release that has been independently reviewed.
• Use a requirements or lock file containing cryptographic hashes, such as a hash-locked requirements.txt.
• Install with hash enforcement, for example through pip install --require-hashes -r requirements.txt.
• Prefer reviewed binary wheels from trusted sources and avoid unexpected source builds.
• Verify package provenance, release signatures, and publisher identity before upgrading.
• Isolate dependency installation in a least-privileged virtual environment or container.
• Establish an explicit dependency-update process that performs vulnerability scanning and code review before changing the pinned version.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:42
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

npm install schemapin

Technical Analysis

The command does not identify an exact reviewed package version or require a committed lockfile. It therefore permits npm to resolve a package release at installation time. The resolved package is external to the audited repository and may change after this Skill has been reviewed.

npm packages can define lifecycle scripts that execute during installation. A compromised publisher account, release pipeline, or registry package could therefore turn this command into an immediate code-execution channel without requiring the application to import the package first.

Attack Path

1. An attacker gains control of the npm publisher account, publishing pipeline, or registry package.
2. The attacker publishes a malicious release containing a lifecycle script or malicious runtime code.
3. A user or AI agent executes the documented unpinned installation command.
4. npm resolves and downloads the attacker-controlled release.
5. A lifecycle script executes during installation, or malicious code executes when the package is imported.
6. The payload operates with the permissions and credentials available to the npm or application process.

Impact Assessment

Successful exploitation could provide code execution under the installing user's account. The attacker could read accessible source code and environment variables, steal CI/CD tokens or cryptographic signing keys, modify application artifacts, and communicate with external systems. In privileged build environments, the compromise could propagate into generated or published packages.

Remediation

View remediation

Remediation Suggestions

• Pin the package to an exact reviewed version rather than allowing implicit latest-version resolution.
• Commit and enforce a reviewed package-lock.json, and use npm ci for reproducible installation.
• Verify registry provenance and package integrity metadata before accepting upgrades.
• Use npm ci --ignore-scripts where lifecycle scripts are unnecessary; explicitly review any lifecycle scripts that must be enabled.
• Run installation in an isolated, least-privileged environment without signing keys or unrelated credentials.
• Apply dependency scanning and manual review to every lockfile update.
• Consider registry allowlisting and trusted internal mirrors for CI/CD environments.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md

Sign entire skill directories (e.g., a folder containing `SKILL.md`) with ECDSA P-256. Produces a `.schemapin.sig` manifest alongside the files, proving no file

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md

Sign entire skill directories (e.g., a folder containing `SKILL.md`) with ECDSA P-256. Produces a `.schemapin.sig` manifest alongside the files, proving no file

Static analysis

No suspicious patterns detected.