Data Labeling Studio

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:27 AM UTC
• Version: 1.0.0

Overview

The skill does not show exfiltration or persistence, but it substantially overstates real annotation and quality-control behavior while producing mock labels and metrics that users could mistake for genuine results.

Review this skill carefully before installing. It appears more like a mock/demo scaffold than a real data labeling system: do not rely on its generated annotations or quality scores for production datasets, audits, model validation, or compliance decisions. Install only in an isolated environment, pin and review dependencies first, and use explicit output paths you are comfortable creating or overwriting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1-6 (installation instructions at README.md:17-20 and SKILL.md:143-146)
Vulnerability Type: Supply-chain exposure through unbounded dependency resolution
Risk Level: Medium

Complete Vulnerable Code Snippet:

text

Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0
pandas>=2.0.0
librosa>=0.10.0
scikit-learn>=1.3.0

The documented installation command is:

bash

pip install -r requirements.txt

Technical Analysis

All six dependencies use lower-bound-only version constraints. Consequently, package resolution may select any future release satisfying the stated minimum version. The project provides neither a lockfile nor cryptographic hashes with which to verify resolved artifacts.

Python package installation can execute package build or installation logic under the privileges of the user running pip. If an upstream package, maintainer account, distribution artifact, or package index is compromised, a malicious future version could be selected without any change to this repository. Unreviewed future releases can also introduce known vulnerabilities or incompatible behavior.

The dependency names are conventional and no evidence of typosquatting, dependency confusion involving private package names, or an unsafe package index was identified. This finding therefore concerns inadequate dependency pinning and integrity controls rather than a confirmed malicious package.

Attack Path

1. An attacker compromises an upstream maintainer account, package release process, distribution artifact, or configured package index.
2. The attacker publishes a malicious package version that satisfies one of the >= constraints.
3. A user follows the documented pip install -r requirements.txt procedure.
4. The resolver selects the attacker-controlled version because no exact version or trusted hash is required.

...[truncated 783 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin all direct and transitive dependencies to reviewed exact versions through a reproducible lockfile.
2. Generate and verify cryptographic hashes for every resolved distribution, and install with a hash-enforcing workflow such as pip install --require-hashes -r requirements.txt.
3. Generate pinned requirements using a dependency-management tool such as pip-tools, Poetry, or an equivalent reproducible resolver.
4. Review dependency updates before merging them and use automated vulnerability and supply-chain scanning.
5. Prefer a trusted, explicitly configured package index and prevent unintended fallback to untrusted indexes.
6. Install dependencies in an isolated virtual environment or container under a non-privileged account.
7. Document the verified Python version and supported platform artifacts so installations consistently use reviewed packages.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The module is presented as an "Image Annotation Tool," and methods like annotate and save are described as performing annotation and saving annotation results. In reality, the core behavior at L87 calls a mock generator that assigns random labels and coordinates, so the output is synthetic rather than actual user- or model-derived annotations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The command-line interface advertises annotation types and formats such as "segmentation", "pascal_voc", and "yolo", and also exposes "--pre-annotate" and active learning options. However, the implementation only generates mock bounding-box/polygon/keypoint data, saves true COCO output or raw JSON fallback, and never uses the pre_annotate flag or active-learning settings during annotation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file's title and multiple docstrings are written in Chinese, indicating a language-specific presentation, while the tool description and interface do not offer any user opt-in or language selection. This can violate language/locale policy when a skill implicitly forces a specific language experience.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function claims to evaluate IoU quality but actually returns pseudo-random simulated scores derived from object hashes rather than comparing annotations to ground truth. This can mislead users into trusting fabricated quality metrics, causing bad datasets to be accepted and downstream model validation or release decisions to be based on false results.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The tool reports hardcoded or mock values such as accuracy=0.87 and fallback IoU=0.82 as if they were genuine evaluation outputs. In a quality-checking skill, this is dangerous because it creates false assurance, undermines auditability, and may directly influence dataset acceptance, compliance evidence, or model readiness decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill documentation states that dataset_export writes labeled datasets to an output_dir, and earlier examples also show annotation outputs being written to files. The markdown does not include any explicit warning that these operations will create or overwrite files in user-specified locations, which is a user-data-affecting behavior relevant under the markdown warning criterion.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The dependency is specified with a minimum version only, so installs may resolve to different newer releases over time. This weakens reproducibility and makes it harder to verify whether a deployed environment is using a version affected by a known vulnerability or breaking change.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0
pandas>=2.0.0

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Pillow has multiple known advisories, and because the manifest does not pin an exact version, it is impossible to verify from this file whether a safe release will be installed. In a skill that processes image/media content, that uncertainty is more relevant because image-parsing libraries have historically had memory corruption, resource exhaustion, and code-execution bugs.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The opencv-python requirement is not strictly pinned, allowing dependency resolution to vary across installations. This creates supply-chain and patch-verification uncertainty because the actual installed version may differ from the one tested or reviewed.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0
pandas>=2.0.0
librosa>=0.10.0

Unverifiable Dependency: opencv-python has 16 known advisory(ies) (CVE-2017-12864 (Integer Overflow or Wraparound in OpenCV); CVE-2017-12598 (Out-of-bounds Read in OpenCV ); CVE-2019-14493 (NULL Pointer Dereference in OpenCV.) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

opencv-python has a history of security advisories, and the unpinned requirement prevents confirmation that deployment will use a non-vulnerable build. Given this appears to be a media-processing skill, unsafe image/video parsing bugs in OpenCV could become reachable if untrusted content is handled.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using numpy with only a lower bound permits unreviewed newer versions to be installed. That reduces build reproducibility and makes it difficult to confirm exposure to dependency vulnerabilities or incompatible behavior.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0
pandas>=2.0.0
librosa>=0.10.0
scikit-learn>=1.3.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

numpy has known advisories, but the current manifest only sets a minimum version, so the actual installed release cannot be verified from this file. This creates uncertainty around whether vulnerable or incompatible versions may be resolved in different environments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The pandas dependency is unpinned, so different environments may receive different versions. This can introduce unreviewed security fixes, regressions, or vulnerable releases without clear traceability.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

Pillow>=10.0.0
opencv-python>=4.8.0
numpy>=1.24.0
pandas>=2.0.0
librosa>=0.10.0
scikit-learn>=1.3.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

pandas has at least one known advisory, and because the dependency is not pinned, this manifest does not establish whether installations are safe. While the direct exploitability depends on how pandas is used, unverifiable dependency versions still represent avoidable supply-chain risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The librosa requirement allows any version at or above the minimum, which makes builds non-deterministic. Even without a cited advisory here, unpinned dependencies increase supply-chain risk and complicate incident response.

Content

Scanner excerpt · requirements.txt (reported line 5)May include surrounding context.

text

opencv-python>=4.8.0
numpy>=1.24.0
pandas>=2.0.0
librosa>=0.10.0
scikit-learn>=1.3.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The scikit-learn package is not fixed to a single version, so installations may drift over time. This makes it harder to guarantee that a safe, tested release is deployed and to assess exposure to known issues.

Content

Scanner excerpt · requirements.txt (reported line 6)May include surrounding context.

text

numpy>=1.24.0
pandas>=2.0.0
librosa>=0.10.0
scikit-learn>=1.3.0

Unverifiable Dependency: scikit-learn has 6 known advisory(ies) (CVE-2020-13092 (scikit-learn Deserialization of Untrusted Data); CVE-2024-5206 (scikit-learn sensitive data leakage vulnerability); CVE-2020-28975 (scikit-learn Denial of Service) +3 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

scikit-learn has several known advisories, and the absence of exact version pinning means the deployed release cannot be validated from the manifest. If the skill loads models or serialized data, some scikit-learn issues can become more relevant, so version uncertainty is undesirable.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.