NBA Tracker

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:12 AM UTC
• Version: 1.0.3

Overview

This NBA helper is mostly purpose-aligned, but its calendar example can modify Apple Calendar through unsafe AppleScript without clear consent or input escaping.

Install only in an isolated Python environment, prefer pinned dependency versions, and do not let an agent run the Calendar example unless you explicitly want it to create local calendar events. The calendar code should be rewritten to pass values as data or escape and validate them before any osascript use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:223

Finding

AppleScript Injection Through Unsanitized Calendar Event Fields

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: requirements.txt:3

Finding

Unbounded and Unhashed Third-Party Dependencies

Content

View full analysis

=1.4.1 pandas>=2.0.0 ``` The installation documentation additionally recommends unconstrained installation: ```bash pip install nba_api pandas ``` ### Technical Analysis Both dependencies use lower-bound-only version constraints. Consequently, an installation can resolve to any future version accepted by the package index. The project does not provide a lock file, upper version bounds, or package hashes to establish a reviewed and reproducible dependency set. This is not evidence that either named package is currently malicious or vulnerable. The risk is that dependency behavior can change after this project has been audited. A future compromised, malicious, or incompatible release could be selected automatically during a fresh installation. Python packages and their transitive dependencies execute code in the application environment at runtime and may also exercise installation-time build behavior. Therefore, uncontrolled package resolution expands the software supply-chain trust boundary. ### Attack Path 1. A user follows the installation instructions or installs the dependencies from `requirements.txt`. 2. The package resolver queries the configured Python package index. 3. It selects current releases satisfying `nba_api>=1.4.1` and `pandas>=2.0.0`, including releases published after this audit. 4. If a selected package or transitive dependency has been compromised or contains a security regression, its code is installed. 5. The dependency code executes when imported or otherwise used by `nba_quick_query.py`. This path depends on an affected package release, package-index compromise, unsafe index configuration, or another supply-chain event; no such active compromise was established during ...[truncated 721 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The calendar example goes beyond a viewing-only assistant by invoking osascript through subprocess.run, which performs local command execution and modifies the user's calendar. Even though the example uses hardcoded values in the sample call, the function is written to accept external inputs (player_name, game_date, matchup, calendar), and directly interpolates them into AppleScript, creating a path to unintended local actions or script injection if reused with untrusted data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill presents calendar modification as a normal example workflow without an explicit warning that it changes user data on the local machine. In an agent setting, this can normalize state-changing behavior and increase the chance that an assistant performs persistent actions without informed consent, which is risky even if the underlying purpose is convenience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This file presents its top-level description, installation guidance, and runtime prompts exclusively in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This markdown file describes direct access to the NBA.com official API and includes many examples that perform live network requests, but it does not warn users that using these endpoints sends request metadata and query parameters to an external service. For markdown files, omissions of warnings about behaviors affecting privacy or system/network activity should be flagged when such external communication is a core documented behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The note says to convert NBA times to local timezone with a Beijing-specific offset, which imposes a particular locale assumption in natural language. This can violate language/locale policy when the skill does not offer a user choice or clarify that the example is region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified with a lower bound only, which allows future unresolved versions to be installed. This creates supply-chain and reproducibility risk because a later release could introduce a breaking change or a vulnerable version without the skill author explicitly reviewing it.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

# NBA Tracker Skill 依赖

nba_api>=1.4.1
pandas>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The pandas dependency is not pinned to a specific version, so installations may resolve to different releases over time. That increases supply-chain risk and makes it harder to ensure that deployed environments avoid vulnerable or untested versions.

Content

Scanner excerpt · requirements.txt (reported line 4)May include surrounding context.

text

# NBA Tracker Skill 依赖

nba_api>=1.4.1
pandas>=2.0.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.