Unpinned Dependencies
Low
- Category
- Supply Chain
- Content
CairoSVG>=2.7
- Confidence
- 94% confidence
- Finding
- CairoSVG>=2.7
Security audit
majia-chatcut-koubo · 马甲实战版
Security checks across malware telemetry and agentic risk
Overview
This is a coherent ChatCut editing/design skill with an optional dependency hygiene issue, not hidden or malicious behavior.
Safe to install for ChatCut editing workflows. If you plan to regenerate PNG backgrounds, pin CairoSVG to a patched version such as 2.9.0 or newer and avoid rendering untrusted SVG files without resource limits.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)
Known Vulnerable Dependency: CairoSVG==2.7 — 2 advisory(ies): CVE-2026-31899 (CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification); CVE-2026-31899 (CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to Koz)
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
- CairoSVG==2.7
VirusTotal
60/60 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.