Leo CSV Stats Analyzer

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:36 AM UTC
• Version: 1.0.0

Overview

This skill reads a user-provided CSV and reports basic statistics, with no evidence of hidden data access, persistence, or destructive behavior.

This skill appears appropriate for basic CSV analysis. Before installing, consider running it in a normal least-privilege environment and pinning pandas if reproducible or audited dependency behavior matters to you.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Runtime Dependency Resolution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Complete Code Snippet:

text

- Run it with: uv run --with pandas {baseDir}/analyzer.py [csv-path]

Technical Analysis

The documented invocation uses uv run --with pandas to resolve and install pandas dynamically at runtime without specifying an audited version or requiring a committed lockfile. Consequently, the package version and its transitive dependency graph may change between executions.

This creates a supply-chain risk: if a future resolved release or one of its dependencies is compromised, malicious code could execute when the dependency is loaded by analyzer.py. The absence of version and integrity constraints also makes builds non-reproducible. No evidence indicates that the current pandas package is malicious; the vulnerability is the unsafe dependency-resolution practice.

Attack Path

1. An attacker compromises a future version of pandas or a transitive dependency available through the configured package source.
2. A user invokes the Skill using the documented uv run --with pandas command.
3. Because no version or lockfile constraint is enforced, uv resolves and downloads the affected release.
4. analyzer.py executes import pandas as pd.
5. Malicious initialization code in the compromised dependency executes with the permissions and environment access of the Agent process.

Impact Assessment

Successful exploitation could execute arbitrary code with the same operating-system privileges as the process running the Skill. This could expose files, environment variables, credentials, or other resources accessible to that process, and could alter analysis results or compromise the Agent environment. The code does not itself obtain elevated privileges, so the scope remains bounded by the invoking process's existing permissions and any sur ...[truncated 26 chars]

Remediation

View remediation

Remediation Suggestions

• Pin pandas to a specific, reviewed version rather than resolving the latest available release at each invocation.
• Declare dependencies in a project configuration and commit the generated lockfile.
• Invoke uv in locked or frozen mode so execution fails if dependency resolution differs from the reviewed lockfile.
• Retain and verify package integrity metadata where supported.
• Review and update pinned direct and transitive dependencies through a controlled dependency-update process.
• Prefer a pre-provisioned, trusted environment instead of downloading dependencies during each Skill invocation.
• Run the Skill with least privilege and restrict its filesystem, network, credential, and environment-variable access to reduce the impact of a dependency compromise.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.