Production Scheduling

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:06 AM UTC
• Version: 1.0.0

Overview

This is a coherent production-scheduling guidance skill, with scanner findings mostly explained by domain text and eval-only files rather than hidden or unsafe runtime behavior.

Install is reasonable for production-scheduling advice, but treat generated schedules, overtime plans, subcontracting recommendations, ERP changes, and customer messages as drafts requiring human review against real contracts, labor rules, regulatory requirements, and current plant data. Do not run the bundled eval script unless the referenced shared eval framework path is trusted and isolated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: evals/run_evals.py:7

Finding

Untrusted External Python Module Loading via Import Path Manipulation

Content

View full analysis

Vulnerability Details

File Location: evals/run_evals.py, lines 7–10
Vulnerability Type: Insecure dependency loading and local module substitution
Risk Level: High

Vulnerable code:

python

REPO_ROOT = Path(__file__).resolve().parent.parent.parent.parent
sys.path.insert(0, str(REPO_ROOT / "shared"))

from eval_framework import main

Technical Analysis

The evaluation runner derives a dependency directory by traversing four parent directories from its own location, prepends the resulting shared directory to sys.path, and then imports eval_framework without validating the module's origin or integrity.

In the audited deployment layout, this resolves to /tmp/shared, which is outside the audited project directory. Because sys.path.insert(0, ...) gives that directory precedence over other import locations, a substituted eval_framework.py or eval_framework package in that directory is imported first. Python executes module-level code immediately during import, before main() is called.

This creates a dependency-substitution risk at a local, ancestor-derived path. Exploitation requires an attacker or compromised process to have write access to the resolved external directory. The audit did not establish the directory's actual permissions or confirm that a malicious module exists, so the finding represents an exploitable unsafe loading mechanism rather than evidence of an active payload.

Attack Path

1. An attacker determines that the evaluation runner imports eval_framework from the ancestor-derived shared directory.
2. The attacker obtains write access to that directory, directly or through another compromised process.
3. The attacker creates or replaces /tmp/shared/eval_framework.py, or an equivalent package, with malicious module-level code and a compatible main symbol.
4. A user launches python evals/run_evals.py.
5. The runner places /tmp/shared at the beginning of ...[truncated 902 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the ancestor-derived sys.path modification and package eval_framework as a normal trusted dependency.
2. Pin the dependency to an approved version and verify its integrity using lock files and cryptographic hashes.
3. If the framework belongs to the same repository, place it inside a trusted package tree and use an explicit package import.
4. If external loading is unavoidable:
   • Obtain the dependency root from a trusted, validated configuration.
   • Resolve the path canonically.
   • Verify that it is inside an approved directory.
   • Reject writable shared or temporary directories.
   • Verify the dependency against an expected cryptographic digest before loading it.
5. Run evaluation tooling under a least-privileged account in a sandbox with restricted filesystem and network access.
6. Add a startup assertion that logs and validates eval_framework.__file__ against the expected trusted location.
7. Add a security regression test ensuring that an unexpected module in an ancestor or temporary directory cannot shadow the approved framework.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (6)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · evals/scenarios.json (reported line 433)May include surrounding context.

json

"criterion": "subordination_logic",
          "weight": 0.20,
          "rubric": {
            "pass": "Notes that non-constraint work centres (heat treatment at 60%, finishing at 68%, inspection at 55%) should NOT be scheduled for maximum utilisation. Their schedules should be subordinated to the constraint's needs. Finishing must maintain sprint capacity to clear TMC-01 output promptly. Sawing (85%) is the nearest to becoming a secondary constraint and should be monitored.",
            "fail": "Attempts to maximise utilisation at all work centres. Does not mention subordination."
          }
        }

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 70% confidence

Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · references/decision-frameworks.md (reported line 710)May include surrounding context.

md

- Check union contract or labour regulations. Many agreements require offering overtime
     by seniority before mandating it. Mandatory overtime may require 24–48 hours' notice.
   - Violating overtime assignment rules costs more in grievances and morale damage than
     the production it generates. Always comply.

3. **Fatigue and safety risk:**
   - Operators who have already worked 10+ hours should not be assigned to the constraint

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/rubric.md (reported line 195)May include surrounding context.

md

- Correct differentiation between: constraint vs. non-constraint, buffer time vs. buffer inventory, forward vs. backward scheduling, finite vs. infinite capacity, planned vs. unplanned downtime, setup time vs. run time

**Terminology that signals misunderstanding (negative signal):**
- Calling any work centre with WIP in front of it a "bottleneck" without checking utilisation
- Using "buffer stock" when the context calls for "time buffer" (DBR)
- Confusing "schedule adherence" with "on-time delivery" (they measure different things)
- Using "capacity" interchangeably with "utilisation"

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/scenarios.json (reported line 955)May include surrounding context.

json

- Correct differentiation between: constraint vs. non-constraint, buffer time vs. buffer inventory, forward vs. backward scheduling, finite vs. infinite capacity, planned vs. unplanned downtime, setup time vs. run time

**Terminology that signals misunderstanding (negative signal):**
- Calling any work centre with WIP in front of it a "bottleneck" without checking utilisation
- Using "buffer stock" when the context calls for "time buffer" (DBR)
- Confusing "schedule adherence" with "on-time delivery" (they measure different things)
- Using "capacity" interchangeably with "utilisation"

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

This JSON file is a manifest-like scenario definition, so SQP-1 applies. The task text is written as a general instruction (for example, 'Determine the optimal job sequence for the day shift') without any explicit indication of when this scenario should be invoked versus ignored, or any negative examples, which makes the trigger scope underspecified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file provides an external customer communication template that inserts {{scheduler_phone}} into a customer-facing message. The file does not include any warning or guidance about verifying that personal or direct contact information is approved for external sharing, which is a privacy-relevant behavior for a communication template.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.