Doc-to-LoRA

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:03 PM UTC
• Version: 1.2.0

Overview

The skill has a coherent Doc-to-LoRA purpose, but setup and checkpoint loading create review-worthy code-execution risk unless users tightly control the repository, dependencies, and model files.

Install only in a trusted Doc-to-LoRA repository clone, inspect the repository's install_mac.sh before setup, prefer pinned/locked dependencies, and load only official or hash-verified checkpoints. Protect HF_TOKEN and avoid the unpinned npx install path unless you trust the installer and source revision.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/internalize.py:67

Finding

Arbitrary Code Execution Through Unsafe PyTorch Checkpoint Deserialization

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:44

Finding

Execution of an Unverified Setup Script From the Enclosing Repository

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:62

Finding

Unpinned Python Dependencies Installed From a Mutable Package Source

Content

View full analysis

/dev/null || true ``` ### Technical Analysis The setup process installs `mlx`, `mlx-lm`, and `safetensors` without exact versions, hashes, or a lockfile. Each setup can therefore resolve to different package artifacts. A compromised package release, registry account, package index, or transitive dependency can introduce attacker-controlled installation or runtime code. The `|| true` suffix forces setup to continue after any installation failure, while `2>/dev/null` suppresses diagnostic output. This behavior can conceal dependency-resolution, integrity, or build failures and leave an inconsistent environment. The code contradicts the setup comments and Skill documentation claiming that dependency installations use pinned versions. ### Attack Path 1. An attacker compromises a package release, a transitive dependency, or the package source used by `uv`. 2. The user runs `scripts/setup.sh`. 3. `uv pip install` resolves the mutable latest package versions because no versions or hashes are specified. 4. A malicious package or build backend executes during installation, or malicious package code runs when `query_mlx.py` imports it. 5. Errors that might reveal an abnormal installation can be hidden by stderr redirection and ignored by `|| true`. ### Impact Assessment A malicious dependency can execute code with the privileges of the user running setup or inference. It may access project files, documents, adapters, model data, credentials in the environment, and available network resources. The absence of version locking also creates reproducibility and compatibility risks e ...[truncated 46 chars]

Remediation

View remediation

/dev/null || true`; installation failures should stop setup and display actionable diagnostics. 6. Regularly review locked dependency updates and use automated vulnerability and provenance scanning. 7. Update the documentation so its dependency-pinning claims accurately reflect the enforced setup behavior. ]]>

T08 · Insecure Dependencies

Note

• Location: README.md:39

Finding

Documentation Recommends Unpinned npx Installer Execution

Content

View full analysis

/doc-to-lora-skill ``` ``` ### Technical Analysis The documented installation command invokes `npx` without pinning the `skills` package to an exact reviewed version. Depending on the local npm cache and configuration, `npx` can retrieve and execute package code from a remote registry. The Skill repository reference is also represented as a mutable owner/repository identifier rather than an immutable commit. Therefore, both the installer implementation and the installed Skill content may change after this audit. This is a documentation-driven supply-chain risk rather than malicious code embedded in the supplied project. ### Attack Path 1. A user replaces the placeholder with a repository identifier and follows the documented command. 2. `npx` resolves a mutable version of the `skills` package from its configured package source. 3. A compromised or malicious package version executes as part of the installation workflow. 4. The installer may then retrieve mutable Skill content from the referenced repository. 5. The downloaded code executes with the permissions of the user running the command. ### Impact Assessment A compromised installer can execute arbitrary commands with the invoking user's privileges and can read or modify user-accessible files and credentials. It may also install altered Skill instructions or scripts that affect future agent sessions. The practical likelihood is lower than the directly invoked setup issues because exploitation requires the user to choose this optional installation method and an upstream compromise or malicious source. ]]>

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 37)May include surrounding context.

sh

if [ -z "$HF_TOKEN" ]; then
    echo "ERROR: HF_TOKEN is not set."
    echo "Gemma 2 2B is a gated model requiring a HuggingFace access token."
    echo "1. Get a token at: https://huggingface.co/settings/tokens"
    echo "2. Accept Gemma license at: https://huggingface.co/google/gemma-2-2b-it"
    echo "3. Run: export HF_TOKEN=hf_your_token_here"

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx skills add <owner>/doc-to-lora-skill without pinning an exact package version or commit, which can cause execution of whatever package version is current at install time. If the referenced package or one of its transitive dependencies is compromised, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill describes use of environment secrets (HF_TOKEN) and file read/write operations, but it does not declare any explicit tool scope or allowed-tools restrictions. That creates an authorization gap: an agent may execute the skill with broader capabilities than intended, increasing the chance that sensitive files or environment variables are accessed or written without clear policy boundaries.

Content

No source excerpt is available for this finding.

Insecure deserialization: torch.load() without weights_only=True

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The code explicitly calls torch.load(..., weights_only=False), which uses Python pickle-style deserialization and can execute attacker-controlled code during checkpoint loading. Although the script warns to use only trusted checkpoints, the --checkpoint argument is user-controllable and the safety relies entirely on operator discipline rather than technical enforcement.

Content

Scanner excerpt · scripts/internalize.py (reported line 61)May include surrounding context.

python

# weights_only=False is needed: checkpoint contains config dataclasses
    # (AggregatorConfig, LoraConfig, HypernetConfig) not just tensors.
    # Only load from trusted sources.
    state_dict = torch.load(checkpoint_path, map_location="cpu", weights_only=False)
    if device_map != "cuda":
        state_dict["ctx_encoder_args"].quantize_ctx_encoder = False
    else:

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code loads a model by name using load(args.model, ...), which commonly fetches model artifacts from a remote repository if not already cached. Although the script prints the model name, it does not explicitly warn users that running it may initiate network access or remote downloads.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/internalize.py:82