T08 · Insecure Dependencies
Warning
- Location
SKILL.md:18- Finding
Unpinned Third-Party Python Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
MJ Windows Faster Whisper
Security checks for vulnerabilities and agentic risk
Overview
This skill is a straightforward local speech-to-text helper, with ordinary setup risks from third-party packages and model downloads.
Install the dependencies in a dedicated virtual environment or container, prefer pinned package versions from trusted indexes, and understand that first-time setup will contact GitHub/Hugging Face and store a local model cache.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
Lines L25-L26 direct the user to use a GitHub repository and download a model from Hugging Face, which implies external network access and data transfer. The skill description does not include any warning that setup requires contacting third-party services.
- Content
Static analysis
No suspicious patterns detected.