T08 · Insecure Dependencies
Warning
- Location
SKILL.md:6- Finding
Incorrect pip command creates an unsafe and ambiguous dependency installation path
- Content
View full analysis
- Remediation
View remediation
Security audit
LOFMonitor Finance Stock Investment
Security checks for vulnerabilities and agentic risk
Overview
This is a coherent LOF fund monitoring skill with ordinary network data retrieval and local output, but its installation instructions need hardening.
Before installing, use a virtual environment, correct the install command to use a requirements file, and prefer pinned or locked dependency versions. Expect the script to contact public financial data sources and overwrite LOFMonitor_output.txt in the working directory.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Dependencies are not pinned or protected with integrity hashes
- Content
View full analysis
=1.10.0 pandas>=1.5.0 requests>=2.28.0 ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. No maximum version, exact version, lock file, or package hash is provided. A future installation can therefore select dependency releases that did not exist when the skill was reviewed. Python packages may execute code during build or installation, and their imported modules execute within the skill's process. If a permitted future release or one of its transitive dependencies is compromised, pip may install it automatically while still satisfying these constraints. The absence of hashes prevents pip from verifying that downloaded artifacts match artifacts explicitly approved by the project maintainer. This also makes installations non-reproducible: two installations performed at different times can resolve materially different code without any change to this repository. ### Attack Path 1. An attacker compromises a permitted dependency release, its maintainer account, distribution infrastructure, or a transitive dependency. 2. The attacker publishes a newer version satisfying the declared lower-bound constraint. 3. A user installs the project dependencies without a previously reviewed lock file or hashes. 4. Pip resolves the compromised release because it satisfies the `>=` constraint. 5. Malicious code executes during package installation, package build processing, import, or subsequent skill execution. 6. The code operates with the privileges of the user running the installation or skill. This path requires compromise or malicious publication in the dependency chain; the repository itself does not directly retrieve or execute a custom remote payload. ### Impact Assessment A compromised dependency can execute ...[truncated 597 chars]- Remediation
View remediation
pandas== requests== ``` 2. Resolve and lock transitive dependencies using a tool such as `pip-tools`, Poetry, or another reproducible dependency manager. 3. Generate hashes for approved distribution artifacts and install with hash verification, such as pip's `--require-hashes` mode. 4. Review dependency updates before modifying the lock file. 5. Run automated vulnerability and provenance checks against both direct and transitive dependencies. 6. Use a trusted internal mirror or explicitly approved package index where appropriate. 7. Install dependencies in an isolated virtual environment with least-privilege permissions. ]]>
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language content of the skill file is entirely in Chinese and does not indicate that the skill is intentionally limited to Chinese-speaking users or A-share specialists as a documented locale policy. Under the policy, forcing a specific language without user opt-in or justification is a natural-language policy violation.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The script creates and overwrites LOFMonitor_output.txt as part of its main execution flow, but there is no confirmation prompt, warning comment, or user-facing disclosure near the write operation. For a code-file audit, file writes should have some visible disclosure unless clearly documented as expected behavior.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill instructs the user to read a generated local file but does not clearly disclose up front that execution will write data to disk. This is a transparency and safety issue because users may run the tool without understanding that local artifacts will be created, which can affect privacy, storage hygiene, or downstream automation that trusts the workspace state.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This creates supply-chain risk and reduces reproducibility, because a newly introduced vulnerable or breaking upstream release could be pulled in without review.
- Content
text akshare>=1.10.0 pandas>=1.5.0 requests>=2.28.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Using pandas>=1.5.0 does not guarantee which exact version will be installed, making builds non-reproducible and weakening control over supply-chain exposure. If an unsafe upstream version becomes the resolver's choice, deployments may silently inherit that risk.
- Content
text akshare>=1.10.0 pandas>=1.5.0 requests>=2.28.0
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The requests package is also unpinned, so installations may vary across environments and time. This can result in accidental uptake of vulnerable or incompatible releases, which is a standard supply-chain hardening issue.
- Content
text akshare>=1.10.0 pandas>=1.5.0 requests>=2.28.0
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 67% confidence
- Finding
The manifest does not pin requests, so it is impossible to verify from this file alone whether the ultimately installed version is affected by any known advisory. This is dangerous because a vulnerable resolver-selected version could be introduced in some environments without visibility, especially for a widely used HTTP library with a substantial advisory history.
- Content
Static analysis
No suspicious patterns detected.