find-package

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:23 AM UTC
• Version: 1.0.0

Overview

This skill coherently helps users find delivery packages from pickup codes and shelf photos, with privacy and dependency hygiene cautions but no hidden or purpose-mismatched behavior found.

Reasonable to install for Chinese-language package-finding workflows, but users should avoid sending unrelated personal details in screenshots/photos, crop or redact where practical, be careful with bystanders in shelf photos, and preferably install Pillow in a virtual environment with a pinned reviewed version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:16

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md:16-23
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

The installation documentation instructs users to install Pillow without pinning a reviewed version or verifying package integrity:

markdown

### Dependencies

- Python 3
- [Pillow](https://pillow.readthedocs.io/) (used for image annotation)

```bash
pip3 install Pillow

text

The dependency is imported and used by `scripts/annotate.py:21-25`:

```python
try:
    from PIL import Image, ImageDraw, ImageFont
except ImportError:
    print("ERROR: Pillow is required. Install with: pip3 install Pillow", file=sys.stderr)
    sys.exit(1)

Technical Analysis

pip3 install Pillow resolves a mutable package version from the user's configured Python package index. The project provides no exact version constraint, lockfile, package hash, or trusted-index requirement. Consequently, two installations performed at different times may retrieve different artifacts that were not reviewed with this project.

This creates supply-chain exposure if the upstream package, a release artifact, a package-index account, or the user's configured package mirror is compromised. It can also introduce unreviewed behavioral or compatibility changes. This finding does not establish that Pillow itself is malicious; the weakness is the absence of reproducible and integrity-verified dependency resolution.

Attack Path

1. An attacker compromises an upstream release channel, package-index account, distribution artifact, or package mirror used by the victim.
2. The attacker publishes or substitutes a malicious package version that satisfies the unconstrained Pillow requirement.
3. A user follows the documented pip3 install Pillow command.
4. pip resolves and installs the attacker-controlled release because no version or hash is enforced.
5. Malicious installation or runtime code e ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a dependency manifest that pins Pillow to a specifically reviewed version, for example:

   text

   Pillow==<reviewed-version>
   

2. Generate and enforce cryptographic hashes for approved distribution artifacts, such as with a hash-locked requirements file and:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Commit the dependency file to the project and update the README to use it instead of installing an unconstrained package directly.

4. Review dependency updates before changing the pinned version and use automated vulnerability and provenance checks in CI.

5. Recommend installation inside a dedicated virtual environment under a non-privileged user account.

6. Use an explicitly trusted package index or controlled internal mirror where appropriate, and avoid running pip with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README instructs users to send pickup codes and photos, including screenshots from courier apps, but provides no warning that these may contain personal or sensitive information. This increases the risk of users exposing tracking details, phone numbers, addresses, or incidental bystander imagery without informed consent or minimization.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger examples and description are broad enough that ordinary delivery-related messages or even a standalone pickup code could activate the skill without clear user intent. In a workflow involving package codes and shelf photos, this can cause accidental collection and processing of sensitive personal data or images in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger scope is very broad and can activate on generic delivery-related phrases or even a standalone code, which risks invoking the skill without clear user intent to analyze package photos. That can cause unintended collection or processing of sensitive images and delivery metadata, especially in chats where the user is only discussing deliveries rather than asking for image-based package location help.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Mandating Chinese-only communication can reduce user comprehension and informed consent if the user is not comfortable in Chinese, particularly when confirming OCR-extracted pickup codes or requesting shelf photos. In this context, misunderstanding could lead to incorrect package matching, accidental disclosure of pickup information, or the user following instructions they did not fully understand.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Requiring the assistant to always communicate in Chinese hard-codes a language constraint that may prevent users from understanding privacy-relevant steps and result confirmations. Although not directly enabling code execution or privilege abuse, it increases the chance of user error and inadvertent sharing of delivery details in a workflow that handles images and pickup codes.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The entire README and all example trigger phrases are presented only in Chinese, and the usage text implies interaction in that language without mentioning alternatives. This can constitute a language-policy issue when a skill effectively requires a specific language without explicit user opt-in or documented locale limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.