Security audit

Bracket Oracle

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed basketball bracket tool with optional premium KenPom credential use, but users should handle those credentials and dependencies carefully.

Install only from trusted package indexes, prefer pinned dependencies if you use KenPom, and keep KENPOM_EMAIL/KENPOM_PASSWORD in a local environment or secrets manager rather than source files. The free Torvik workflow avoids premium credentials.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:66
Finding: Unpinned Third-Party Dependency Is Entrusted with KenPom Account Credentials
Content: View full analysis
list[dict]: """ Fetch team ratings from KenPom (requires subscription). Credentials can be passed directly or set as env vars: KENPOM_EMAIL, KENPOM_PASSWORD """ email = email or os.environ.get("KENPOM_EMAIL") password = password or os.environ.get("KENPOM_PASSWORD") if not email or not password: print("[kenpom] No credentials. Use Torvik (free) or set KENPOM_EMAIL/KENPOM_PASSWORD.") return [] cache_file = DATA_DIR / f"kenpom_{year}.json" if cache_file.exists() and not force: age_hours = (datetime.now().timestamp() - cache_file.stat().st_mtime) / 3600 if age_hours < 12: with open(cache_file) as f: return json.load(f) try: from kenpompy.utils import login import kenpompy.summary as kp browser = login(email, password) df = kp.get_efficiency(browser, season=str(year)) teams = df.to_dict("records") with open(cache_file, "w") as f: json.dump(teams, f, indent=2, default=str) return teams except ImportError: print("[kenpom] kenpompy not installed. Run: pip install kenpompy") return [] except Exception as e: print(f"[ke ...[truncated 2614 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The module docstring presents the file as a set of scrapers for bracket data sources, but the KenPom path goes beyond simple public scraping by reading credentials from environment variables and logging into a subscription service. With no manifest available to justify secret handling, this authenticated credential use is an additional capability that is not clearly required by the stated file-level purpose.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: This code accesses sensitive environment variables (KENPOM_EMAIL and KENPOM_PASSWORD), which falls under safety-relevant credential handling. While the function docstring notes that credentials can come from env vars, there is no clear runtime disclosure to the end user when those credentials are consumed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This markdown file documents use of KENPOM_EMAIL and KENPOM_PASSWORD environment variables, but provides no warning about storing premium-service credentials securely or avoiding accidental disclosure. Under the markdown variant of SQP-2, credential-related behavior that can affect privacy should include a user-facing warning.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.