Spikecv Helper

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:12 AM UTC
• Version: 1.0.2

Overview

This SpikeCV helper is a coherent documentation skill, but users should review the install and download commands before running them.

Install this only if you want an agent to help with SpikeCV setup and CLI workflows. Before running its commands, use a virtual environment or container, consider pinning the SpikeCV repository to a reviewed commit, verify Miniconda installers where possible, and confirm dataset downloads and conda init shell-profile changes are acceptable.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Unpinned Remote Repository Is Installed as Executable Python Package Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–45
Vulnerability Type: Unpinned and unverified third-party dependency installation
Risk Level: Medium

bash

git clone https://github.com/Zyj061/SpikeCV
cd SpikeCV
pip install .[cli]

Technical Analysis

The instructions clone the mutable default branch of an external Git repository and immediately install it with pip. No reviewed release tag or commit is pinned, and no signature or cryptographic digest is verified.

A Python installation may execute build backend logic and install console entry points or other executable package components. Consequently, the code that runs or is installed can change after this Skill has been reviewed. HTTPS protects the connection in transit but does not guarantee that the current repository contents are the same contents that were previously audited.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or the repository's dependency configuration.
2. The attacker adds malicious package build logic or runtime code to the default branch.
3. A user or Agent follows the documented git clone command and receives the modified branch.
4. The user runs pip install .[cli].
5. Attacker-controlled build or package code executes or is installed under the invoking user's security context.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the account performing the installation. The attacker could access or alter files available to that account, read accessible environment variables and credentials, modify the Python environment, install malicious command-line entry points, and make outbound network connections.

The documented commands do not request elevated privileges, so the direct impact is normally limited to the invoking user and resources accessible to that user. Greater impact would be possible if the comman ...[truncated 62 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a reviewed immutable commit hash or a specific signed release rather than the mutable default branch.
2. Verify the selected Git commit or release signature before installation.
3. Publish and use a dependency lock file containing exact versions and hashes for transitive dependencies.
4. Install in a dedicated, non-privileged virtual environment or container.
5. Review the pinned package's build configuration and build backend before running pip install.
6. Prefer binary artifacts produced by a trusted build pipeline and verify their published SHA-256 hashes or signatures.

T03 · Remote Payload Retrieval and Execution

Warning

• Location: references/install_miniconda.md:32

Finding

Downloaded Miniconda Installers Are Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: references/install_miniconda.md, lines 32–47 and 60–67
Vulnerability Type: Remote payload retrieval and execution without checksum or signature verification
Risk Level: Medium

Linux and macOS workflow:

bash

# Download installer (prefer wget, fallback to curl)
if command -v wget > /dev/null; then
    wget "$MINICONDA_URL" -O ~/miniconda.sh
elif command -v curl > /dev/null; then
    curl -L "$MINICONDA_URL" -o ~/miniconda.sh
else
    echo "Neither wget nor curl found. Please install one."
    exit 1
fi

# Silent install to $HOME/miniconda
bash ~/miniconda.sh -b -p $HOME/miniconda

# Initialize conda (adds conda to PATH and enables `conda activate`)
# NOTE: YOU MUST RESTART YOUR TERMINAL after this step
~/miniconda/bin/conda init

Windows workflow:

powershell

# Download Miniconda installer
$url = "https://repo.anaconda.com/miniconda/Miniconda3-latest-Windows-x86_64.exe"
$installer = "$env:TEMP\miniconda.exe"
Invoke-WebRequest -Uri $url -OutFile $installer

# Silent install for current user (no admin required)
# Note: /D defines the custom installation path and MUST be the last argument
Start-Process -Wait -FilePath $installer -ArgumentList "/InstallationType=JustMe /RegisterPython=0 /S /D=$env:USERPROFILE\miniconda3"

Technical Analysis

The documentation downloads executable installers and runs them without checking a cryptographic checksum or digital signature. The Unix URLs use mutable latest artifacts, so the effective payload can change after the Skill has been audited. The Windows installer is likewise executed based only on its download URL.

HTTPS provides transport encryption and server authentication but does not pin the exact installer artifact. It does not protect users if the distribution server, publishing process, signing account, or trusted endpoint is compromised. Silent installation also reduces the opportu ...[truncated 1708 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable latest URLs with a specific Miniconda version.
2. Obtain the expected SHA-256 digest from an independently trusted official source.
3. Verify the downloaded file before execution and terminate immediately on any mismatch.
4. Verify platform-supported digital signatures where available, including Authenticode validation on Windows.
5. Keep installer retrieval and execution as separate, explicit steps so users can inspect verification results.
6. Run installation as a non-administrative user in an isolated environment.
7. Document the shell files that conda init is expected to modify and advise users to review the resulting changes.
8. Remove the downloaded installer after successful verified installation, including the Unix ~/miniconda.sh file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill description is broadly scoped around 'questions and execute tasks for SpikeCV' and can trigger on general SpikeCV-related conversation, increasing the chance the agent enters an action-oriented mode without sufficiently specific user intent. In context, this is not overtly malicious, but it raises the risk of unnecessary command suggestions or operational steps being injected into otherwise informational conversations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill provides dataset download and execution steps that perform network access and create local files, but it does not require an explicit warning or confirmation before those actions are proposed or executed. In an agent setting, this can lead to silent downloads, storage consumption, and unintended external connectivity, especially because the skill normalizes command execution as part of a 'quick health check.'

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/install_miniconda.md (reported line 80)May include surrounding context.

conda --version

text

## Post-installation: Create an environment

```bash
# Create a new environment with a specific Python version

Static analysis

No suspicious patterns detected.