GI Security Audit

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:31 AM UTC
• Version: 1.0.0

Overview

This is a straightforward security-audit checklist skill with some broad activation wording and unpinned audit-tool install examples, but no hidden, destructive, persistent, or exfiltrating behavior.

Installers should treat this as a security-review checklist. If following the optional pip commands, use an isolated virtual environment or pipx, avoid running as root, and prefer pinned versions from a trusted package source. Be aware that the skill may activate for broad security-adjacent requests, so users should define the audit scope clearly.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:45

Finding

Unpinned Third-Party Security Tool Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-52
Vulnerability Type: Unpinned third-party dependencies installed from a mutable package index
Risk Level: Medium

Vulnerable Code

bash

# Python dependencies
pip install safety
safety check

# Alternatively, use pip-audit
pip install pip-audit
pip-audit

Technical Analysis

The Skill directs users or agents to install safety and pip-audit without pinning reviewed versions, verifying artifact hashes, requiring a trusted package source, or isolating the installation from the active environment.

Package names without version constraints resolve to mutable releases and transitive dependencies available through the configured Python package index. If a package release, transitive dependency, package-index configuration, or resolved artifact is compromised, installation or build hooks may execute attacker-controlled code with the privileges of the user running pip.

Installing these tools into the active Python environment can also modify existing dependency versions and affect unrelated project behavior.

Attack Path

1. An attacker compromises a named package, one of its transitive dependencies, or a package source configured in the execution environment.
2. A user or agent follows the Skill and runs pip install safety or pip install pip-audit.
3. pip resolves mutable, unpinned packages from the configured index without validating expected artifact hashes.
4. A malicious package artifact or build hook executes during installation, or malicious code executes when the installed audit command is invoked.
5. The payload gains the operating-system permissions of the invoking account and can access resources available to that account.

This path requires compromise or manipulation of the dependency supply chain; the audited Skill does not itself contain a malicious package or payload.

Impact Assessment

Successful exploitation could execute arbitrary code with t ...[truncated 583 chars]

Remediation

View remediation

Remediation Suggestions

1. Install audit tools in an isolated virtual environment or through pipx rather than modifying the active project or global Python environment.
2. Pin exact, reviewed versions of each direct dependency.
3. Lock all transitive dependencies and record cryptographic hashes in a dedicated requirements file.
4. Require hash verification during installation, for example:

bash

python -m venv .audit-venv
.audit-venv/bin/python -m pip install --require-hashes -r audit-tools.txt

5. Obtain packages only from an explicitly configured and trusted package index or an internally controlled artifact repository.
6. Review and update the lock file through a controlled dependency-update process that includes provenance and vulnerability checks.
7. Avoid running installation commands as root or with unnecessary system privileges.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description uses broad trigger phrases like security check, dependency scan, and before deploying, which can cause the skill to activate for a wide range of common requests without clear boundaries. In an agentic system, overly broad activation can route sensitive repositories or deployment-related workflows into a skill automatically, increasing the chance of unintended tool use, over-collection of code context, or interference with more appropriate specialized review paths.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage conditions are ambiguous and expansive, including triggers such as before release, before introducing third-party packages, or whenever a user mentions sensitive information or vulnerabilities. This makes the skill easier to invoke unintentionally in routine conversations, which is dangerous because security-audit skills often justify broad scanning behavior and may influence agent decisions in contexts where only a narrow answer was requested.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.