Hallucination Check

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 1.0.0

Overview

The skill is a small hallucination-checking helper that discloses its dependency, but users should treat the unpinned external Python package as the main trust boundary.

Install only if you are comfortable trusting the current uqlm package and its dependencies. Prefer a virtual environment or container, pin the dependency version, and avoid running it where sensitive credentials or broad filesystem access are available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Third-Party Python Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7–8 and 20–22
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable code:

yaml

requires:
  pip: [uqlm]

bash

# Install
pip install uqlm

Technical Analysis

The skill requires users to install uqlm directly from the package index without specifying an exact version, cryptographic hashes, a lockfile, or an independently reviewed source artifact. Its transitive dependencies are likewise unconstrained.

Consequently, the code installed can change between installations without any modification to this skill package. If the upstream package, a maintainer account, its publishing process, or one of its transitive dependencies is compromised, users may retrieve attacker-controlled code. Python package installation can invoke package build hooks when source distributions require building, while importing or executing the installed package runs package-controlled code.

The project contains no local implementation of the documented hallucination-check executable, hallucination_check.check_text API, or rule-based fallback. Therefore, the dependency's relevant behavior could not be verified from the submitted project.

Attack Path

1. An attacker compromises an upstream uqlm release, its publishing account, distribution infrastructure, or a dependency selected during package resolution.
2. The attacker publishes a malicious package version or dependency release that remains compatible with the unconstrained requirement.
3. A user follows the documented pip install uqlm instruction.
4. pip resolves and downloads the attacker-controlled release because no exact version or trusted artifact hash is enforced.
5. Malicious code executes through package build hooks, package import, or subsequent use of the installed functionality.
6. The payload operates with the privileges and environme ...[truncated 649 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin uqlm to a specific version that has been reviewed and tested rather than accepting the latest compatible release.
2. Generate a lockfile that records all transitive dependency versions.
3. Require cryptographic hashes for every downloaded artifact, such as through a hash-locked requirements file and pip install --require-hashes.
4. Document the expected official package source and reject untrusted or unexpected package indexes.
5. Review the pinned package and its transitive dependencies for installation hooks and unsafe runtime behavior.
6. Install and run the dependency in an isolated, least-privilege virtual environment or container without unnecessary credentials or filesystem access.
7. Include the claimed local implementation in the project or explicitly document that all functionality is supplied by the external package, enabling reviewers to identify the actual trust boundary.
8. Use automated dependency monitoring and repeat the security review before updating any pinned version or artifact hash.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The examples and shown output are presented in Chinese, and the document does not indicate that language is configurable or optional. This can violate language/locale policy when a skill appears to assume a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.