Argus — The Hundred-Eyed

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:50 AM UTC
• Version: 1.0.4

Overview

This code-scanning skill is not exfiltrating data, but it needs review because it modifies the Python environment during install and saves scan reports with code snippets locally by default.

Install only in an isolated virtual environment, review the generated report files before sharing the directory, and avoid running the scanner from broad or sensitive directories unless you are comfortable with local reports containing file paths and code excerpts.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:63
• Finding: Unpinned Dependency Installed into the System Python Environment## Vulnerability Details **File Location**: `SKILL.md:63` **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash pip3 install rich --break-system-packages --quiet ``` ### Technical Analysis The installation command downloads `rich` without pinning an exact reviewed version or verifying an integrity hash. Consequently, the installed artifact can vary over time and depends on the configured package index and resolver state. If the package, one of its dependencies, or the configured index is compromised, malicious package code could execute during installation or when the scanner imports `rich`. The `--break-system-packages` option bypasses Python's externally managed environment safeguard. This permits pip to alter the system-managed Python environment, increasing the potential for dependency conflicts and expanding the impact beyond an isolated Skill environment. No dependency confusion or package compromise is demonstrated in the audited artifact; the finding concerns the unsafe dependency acquisition and installation mechanism. ### Attack Path 1. An attacker compromises the configured pip index, the published `rich` distribution, or a dependency selected by the resolver. 2. A user follows the Skill's installation instruction. 3. `pip3` retrieves an unpinned and unverified artifact from the configured index. 4. Installation-time package behavior may execute under the privileges of the user running pip. 5. Because `--break-system-packages` is enabled, the package can modify the system Python environment rather than an isolated virtual environment. 6. The scanner later imports `rich`, providing another opportunity for compromised dependency code to execute. ### Impact Assessment Successful exploitation could execute code with the privileges of the user running the installation or Skill. Within those privileges, malicious dependency code could access l ...[truncated 358 chars]
• Remediation: ## Remediation Suggestions 1. Create and use a dedicated virtual environment instead of modifying system Python. 2. Remove `--break-system-packages`. 3. Pin `rich` and any transitive dependencies to reviewed versions. 4. Use a lock file or requirements file containing cryptographic hashes, and install with `pip install --require-hashes`. 5. Configure an explicitly trusted package index and prevent fallback to uncontrolled indexes. 6. Run installation and scanning as an unprivileged user. 7. Avoid `--quiet` in security-sensitive installation instructions so package source, resolver, and integrity errors remain visible. Example hardened workflow: ```bash python3 -m venv .venv . .venv/bin/activate python3 -m pip install --require-hashes -r requirements.txt ``` The corresponding `requirements.txt` should contain an exact reviewed version and hashes for every resolved package.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documentation states the skill 'Reads local files only', but the embedded code always writes a markdown report locally and may also write JSON output. This mismatch can mislead users into running the skill in sensitive directories or environments where creating artifacts is undesirable, causing unintended persistence of scanned code snippets and findings on disk.

Unrestricted Tool Access

Medium

• Category: Excessive Agency

Content

PYTHON_RULES = [
    ("PY001", "critical", "security",  r"\beval\s*\(",                     "eval() executes arbitrary code — extremely dangerous with user input.",               "Use ast.literal_eval() for safe evaluation of literals."),
    ("PY002", "critical", "security",  r"\bexec\s*\(",                     "exec() executes arbitrary strings as Python code.",                                   "Refactor to avoid dynamic code execution."),
    ("PY003", "critical", "security",  r"\bpickle\.loads?\s*\(",           "pickle.load() can execute arbitrary code when deserialising untrusted data.",         "Use json.loads() or a safe serialisation format instead."),
    ("PY004", "high",     "security",  r"(?i)(password|secret|api_key|token|auth_key)\s*=\s*['\"].+['\"]", "Hardcoded credential detected.",                      "Store secrets in environment variables, never in source code."),
    ("PY005", "high",     "security",  r"shell\s*=\s*True",                "shell=True in subprocess is a command-injection risk.",                               "Pass a list of arguments instead: subprocess.run(['cmd', 'arg'])"),
    ("PY006", "high",     "security",  r"\.execute\s*\(.*(%|\.format\(|f['\"])", "Potential SQL injection via string formatting in execute().",                   "Use parameterised queries: cursor.execute(sql, (param,))"),

• Confidence: 80% confidence
• Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

unique.sort(key=lambda f: (SEV_ORDER.get(f["severity"], 3), f["file"], f["line"]))
display = unique[:MAX_FINDINGS]

# ── Display results ───────────────────────────────────────────────────────────
SEV_COLOUR = {"critical": "red", "high": "orange3", "medium": "yellow", "low": "dim"}

if not unique:

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Context Window Stuffing

Medium

• Category: Memory Poisoning

Content

border_style="cyan"
    ))

# ── Save outputs ──────────────────────────────────────────────────────────────
report_file = f"argus_report_{TODAY}.md"
with open(report_file, "w", encoding="utf-8") as f:
    f.write(f"# 🐛 Argus Code Scan Report — {TODAY}\n\n")

• Confidence: 80% confidence
• Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill writes scan reports to local files automatically, including code excerpts and findings, without a clear upfront warning in the markdown description. In a security-scanning context this increases risk because reports can contain sensitive source lines, credentials detected in code, or confidential file paths, leaving data behind on disk unintentionally.

Static analysis

No suspicious patterns detected.