Powerdrill Data Analysis

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:18 PM UTC
• Version: 0.1.0

Overview

This skill is a legitimate Powerdrill data-analysis client, but it can upload arbitrary local files to a third-party service and delete remote datasets or sessions with weak built-in safeguards.

Install only if you intend to send selected files and analysis questions to Powerdrill. Confirm file paths before upload, avoid regulated or confidential data unless authorized, protect the API key, and be careful with cleanup/delete commands because they can remove remote datasets and sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:27

Finding

Unpinned Third-Party Dependency Installation in Skill Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27
Vulnerability Type: Unpinned dependency installation
Risk Level: Low

Vulnerable Code Snippet:

bash

pip install requests

Technical Analysis

The setup instructions install requests without pinning an audited version or verifying package hashes. Package resolution therefore depends on mutable state in the user's configured Python package index, including transitive dependencies and index precedence.

The package name is legitimate, and the audit found no evidence that the Skill intentionally installs a malicious or typosquatted dependency. However, an unpinned installation creates a supply-chain exposure if a future release, transitive dependency, configured package index, or package distribution is compromised. A source distribution may execute build-time code during installation, while a malicious wheel or dependency may execute when imported by scripts/powerdrill_client.py.

Attack Path

1. An attacker compromises the relevant package release, a transitive dependency, or a package index configured by the user.
2. The user follows the Skill setup instruction and runs pip install requests.
3. Pip resolves the dependency against mutable repository state without a version constraint or required hashes.
4. The compromised distribution is installed.
5. Malicious code executes during package build or when the client imports and uses the installed package.

Impact Assessment

Malicious dependency code would run with the privileges of the user performing installation or executing the Skill. Depending on those privileges, it could access local files, environment variables, and Powerdrill credentials, including POWERDRILL_USER_ID and POWERDRILL_PROJECT_API_KEY. It could also make arbitrary network requests or modify files writable by that user.

The issue does not itself grant elevated operating-system privileges, and successful explo ...[truncated 106 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dedicated dependency file with an audited, exact version:

   text

   requests==<audited-version>
   

2. Generate and record hashes for the package and all transitive dependencies.
3. Require hash verification during installation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Use an isolated virtual environment rather than installing into the global Python environment.
5. Review and update pinned dependencies through a controlled process with vulnerability scanning and regression testing.
6. Where practical, configure pip to use a trusted, explicitly selected package index.

T08 · Insecure Dependencies

Note

• Location: README.md:39

Finding

Unpinned Third-Party Dependency Installation in README

Content

View full analysis

Vulnerability Details

File Location: README.md:39
Vulnerability Type: Unpinned dependency installation
Risk Level: Low

Vulnerable Code Snippet:

bash

pip install requests

Technical Analysis

The README directs users to install the latest package version selected by pip rather than a reviewed and reproducible dependency set. No lock file, exact version constraint, or integrity hash is provided.

Although requests is a legitimate package and no malicious dependency was identified in the audited project, this instruction leaves installation behavior dependent on mutable external package repositories and the user's index configuration. A compromised release, transitive package, or configured index could introduce attacker-controlled code without any change to this repository.

Attack Path

1. A package release, transitive dependency, or configured Python package index becomes attacker-controlled.
2. A user follows the README and executes the unpinned installation command.
3. Pip downloads the currently resolved distribution without repository-provided project hashes being enforced by the command.
4. Attacker-controlled code executes during source-package build or later when the dependency is imported by the Powerdrill client.

Impact Assessment

Exploitation could provide code execution under the account running pip or the Powerdrill client. This may expose files readable by that account, process environment variables, and API credentials used by the Skill. The malicious dependency could also perform unauthorized network communication or alter user-writable files.

Exploitation depends on a separate supply-chain or package-index compromise and does not inherently cross operating-system privilege boundaries.

Remediation

View remediation

Remediation Suggestions

Replace the direct installation command with a reproducible installation procedure:

bash

python -m pip install --require-hashes -r requirements.txt

The referenced dependency file should contain exact versions and verified hashes for requests and every transitive dependency. Keep the README and SKILL.md installation instructions synchronized, recommend an isolated virtual environment, and use automated dependency scanning before accepting version updates.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

md

| `create_dataset()` | `POST /v2/team/datasets` | Create a new dataset |
| `get_dataset_overview()` | `GET /v2/team/datasets/{id}/overview` | Get dataset summary and suggested questions |
| `get_dataset_status()` | `GET /v2/team/datasets/{id}/status` | Check data source sync status |
| `delete_dataset()` | `DELETE /v2/team/datasets/{id}` | Delete a dataset |
| `list_data_sources()` | `GET /v2/team/datasets/{id}/datasources` | List files in a dataset |
| `create_data_source()` | `POST /v2/team/datasets/{id}/datasources` | Add a data source (URL or uploaded file) |
| `upload_local_file()` | `POST /v2/team/file/init-multipart-upload` | Upload a local file via multipart upload |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 80% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 105)May include surrounding context.

md

| `wait_for_dataset_sync()` | `GET /v2/team/datasets/{id}/status` | Poll until all sources are synced |
| `list_sessions()` | `GET /v2/team/sessions` | List analysis sessions |
| `create_session()` | `POST /v2/team/sessions` | Create a new session |
| `delete_session()` | `DELETE /v2/team/sessions/{id}` | Delete a session |
| `create_job()` | `POST /v2/team/jobs` | Run a natural-language analysis query |
| `cleanup()` | (composite) | Delete session and dataset |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/powerdrill_client.py (reported line 119)May include surrounding context.

python

def delete_dataset(dataset_id: str) -> dict:
    """DELETE /v2/team/datasets/{id} - Delete a dataset."""
    user_id, api_key = _get_env()
    resp = _session.delete(
        f"{BASE_URL}/v2/team/datasets/{dataset_id}",

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/powerdrill_client.py (reported line 342)May include surrounding context.

python

def delete_session(session_id: str) -> dict:
    """DELETE /v2/team/sessions/{id} - Delete a session."""
    user_id, api_key = _get_env()
    resp = _session.delete(
        f"{BASE_URL}/v2/team/sessions/{session_id}",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README explicitly promotes uploading local files and sending analysis questions to a third-party service, but it does not warn users that potentially sensitive data will leave the local environment and be processed remotely. In a data-analysis skill, that omission can lead to accidental disclosure of confidential datasets, regulated data, or proprietary business information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill clearly instructs use of environment variables, local file access, and outbound network calls to a third-party API, but the manifest does not declare any tool scope or allowed-tools restrictions. This weakens least-privilege boundaries and makes it easier for an agent runtime to invoke broader capabilities than users may expect, especially when handling local files and credentials.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger description is broad enough to activate on many generic data-analysis requests, including requests to upload files, query datasets, or continue prior analysis. Over-broad activation increases the chance the skill is selected in contexts where the user did not specifically intend third-party Powerdrill use, which can lead to unintended data transfer or destructive actions like deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs uploading local files and sending dataset contents to a remote API, but it does not provide a prominent user-facing warning that sensitive local data will leave the system and be processed by a third party. In a data-analysis skill, this context makes the issue more dangerous because users may provide confidential spreadsheets, reports, or documents and not realize they are being transmitted externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The upload_local_file workflow reads an arbitrary local path and uploads file contents to presigned external upload URLs returned by the service, with no built-in confirmation, path restrictions, or user-visible warning that local data will leave the host. In an agent skill context, this increases the risk of unintended exfiltration if a user or upstream agent supplies a sensitive file path or if the skill is invoked without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The CLI exposes destructive dataset deletion directly, and the command dispatch invokes delete_dataset without any confirmation prompt, dry-run mode, or safety interlock. In a data-analysis skill, datasets may contain valuable uploaded material, so accidental or manipulated invocation can cause irreversible data loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README tells users to export API credentials but does not remind them to keep the values secret, avoid committing them to source control, or prevent exposure in logs and shared shell history. This increases the chance of credential leakage through routine operational mistakes rather than a direct code exploit.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README documents cleanup and delete operations as routine steps without clearly warning that they remove remote datasets and sessions, which may contain user data or ongoing work. That can cause unintended data loss, especially in an agentic context where actions may be executed automatically from user prompts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The CLI cleanup path can delete sessions without a confirmation step, which can prematurely remove analysis state and history. While less severe than dataset deletion, it can still disrupt work or erase context unexpectedly if triggered by mistake or via unsafe automation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.