Python Hardener

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed Python code-hardening workflow, but users should be aware it may rewrite code broadly and contains one unsafe SQL-validation recommendation.

Install only if you want ordinary Python review or fix requests to trigger broad in-place hardening plus a documentation file. Review generated SQL fixes carefully and replace any assert-based security checks with explicit runtime validation such as raising ValueError on invalid identifiers.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:47

Finding

Removable Python Assertion Recommended as SQL Injection Defense

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 47–49
Vulnerability Type: Inadequate SQL identifier validation guidance
Risk Level: Medium

Vulnerable Code Snippet

markdown

- **SQL/NoSQL injection** — table names, column names, or user input interpolated
  directly into query strings via f-strings or `%` formatting. Fix with allowlist
  validation (`assert table in frozenset({...})`); parameterised queries for values.

Technical Analysis

The Skill recommends using a Python assert statement to enforce an allowlist for dynamic SQL identifiers. Assertions are intended for internal correctness checks, not security validation. Python removes them when the interpreter runs with optimization enabled, such as through python -O or PYTHONOPTIMIZE.

If code generated according to this instruction constructs SQL using a user-controlled table name, optimized execution may eliminate the only identifier validation. Parameterized queries do not ordinarily support binding table or column names, so parameterization of values does not compensate for the missing identifier check.

The issue is in the Skill's hardening guidance rather than directly executable project code. Exploitation therefore depends on the Skill generating affected Python code, that code accepting an attacker-controlled SQL identifier, and deployment with assertions disabled.

Attack Path

1. The Skill reviews Python code that dynamically inserts a table or column name into an SQL statement.
2. Following SKILL.md, it protects the identifier using assert identifier in allowed_identifiers.
3. The resulting application is run with python -O, python -OO, or an applicable PYTHONOPTIMIZE setting.
4. Python removes the assertion from executed bytecode.
5. An attacker supplies a crafted table or column identifier.
6. The unchecked identifier is interpolated into the SQL statement.
7. Subject to the database driver, query construction, and database account pri ...[truncated 609 chars]

Remediation

View remediation

Remediation Suggestions

Replace assertion-based security checks with unconditional runtime validation and explicit failure handling:

python

ALLOWED_TABLES = frozenset({"documents", "skills", "symlinks"})

if table not in ALLOWED_TABLES:
    raise ValueError("Unsupported table name")

Apply equivalent validation to every dynamic SQL identifier, including table names, column names, sort directions, and schema names:

1. Define allowlists using trusted constants rather than user-provided configuration.
2. Perform explicit membership checks before constructing the query.
3. Raise ValueError or a domain-specific exception when validation fails.
4. Continue using parameterized queries for all data values.
5. Avoid permitting arbitrary identifier fragments, quoting syntax, expressions, or punctuation.
6. Add tests that run under both standard and optimized Python modes to confirm that validation remains effective.
7. Update the Skill text to state that assert must never enforce authentication, authorization, input validation, or other security boundaries.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises activation on very broad phrases such as 'fix this script', 'improve this code', and 'review and fix', which can match many ordinary Python assistance requests. Overbroad triggers can cause unintended invocation of this powerful rewrite skill in contexts where the user did not explicitly request full hardening, logging changes, docstrings, or file generation, increasing the risk of surprising modifications and unsafe autonomous behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.