Astro Transits

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:54 PM UTC
• Version: 1.0.0

Overview

This skill runs local astrology calculations and the reviewed artifacts do not show hidden, destructive, credential-seeking, or exfiltration behavior.

Install in a virtual environment and consider pinning `pyswisseph` before use. Be aware that saved natal chart JSON contains birth date, time, timezone, and location coordinates, so store it somewhere appropriate.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install pyswisseph

Technical Analysis

The documented setup command installs the currently resolved version of pyswisseph from the user's configured pip package index. The project does not provide a version constraint, cryptographic hash, lockfile, or trusted-index restriction.

Python package installation may execute package-controlled build hooks. Consequently, the effective code installed by this command can change after the Skill has been audited. Exploitation would require compromise or substitution of the dependency, its distribution account, or the configured package index. The audit found no evidence that pyswisseph itself is malicious; the risk arises from the unpinned and unverified installation process.

Attack Path

1. An attacker compromises the dependency's distribution account or a pip index configured on the target system, or otherwise causes a malicious distribution to be resolved.
2. The attacker publishes or substitutes a malicious release under the resolved package identity.
3. A user follows the setup instruction and runs pip install pyswisseph.
4. pip downloads the attacker-controlled distribution because no reviewed version or hash is enforced.
5. Malicious package build or installation logic executes with the privileges of the user running pip.
6. The installed package may execute again when the Skill scripts import swisseph.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the account performing installation or running the scripts. This may expose files, environment variables, astrology input data, and credentials accessible to that account, and may allow modification of user-writable files or installed Python packages.

The im ...[truncated 219 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pyswisseph to a specific, reviewed version rather than resolving the latest available release.
2. Publish a locked dependency file containing cryptographic hashes and install it with pip's --require-hashes option.
3. Generate and review hashes for every permitted distribution artifact and platform.
4. Use the official Python Package Index explicitly, or an internally controlled package mirror, where appropriate.
5. Install dependencies inside an isolated virtual environment under a non-privileged account.
6. Add automated dependency vulnerability and provenance monitoring to the release process.
7. Replace the setup command with a hardened form, such as:

bash

python3 -m pip install --require-hashes -r requirements.txt

The corresponding requirements.txt should pin the reviewed version and include approved SHA-256 hashes.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The code is clearly focused on natal chart generation, not transit analysis or forecasting. It converts birth date/time/timezone to UTC Julian Day, computes planetary positions and houses via Swiss Ephemeris, and outputs natal chart data. This aligns only with the 'natal chart support' portion of the description. The broader declared purpose emphasizes a transit calculator with multiple forecasting and event-detection capabilities, none of which appear in this code chunk. There is no evidence of unrelated or dangerous behavior, and use of Swiss Ephemeris is consistent with the description, but the primary described functionality is materially broader than the implemented behavior here.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The code substantially matches the declared astrology/transit-calculator purpose: it uses Swiss Ephemeris, supports natal chart input, computes daily and weekly transit aspects, and reports stations and ingresses. However, one specifically declared capability—void-of-course Moon—is not present anywhere in the code. The script calculates Moon sign and phase, but does not determine or report void-of-course periods. No suspicious undeclared capabilities, external network access, or unrelated behavior are present. This is a partial description-to-behavior mismatch due to an advertised feature missing from the implementation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes an astrological transit calculator with natal chart support, focusing on calculations such as transits, forecasts, aspects, and chart data. This file adds a separate persistence capability via --save, allowing the skill to write output to any caller-supplied path, which is beyond the described calculation-oriented behavior.

Content

No source excerpt is available for this finding.