Security audit

Ra Pro

Security checks for vulnerabilities and agentic risk

Overview

This research-report skill is mostly coherent, but it needs review because it installs an unpinned Python package into the system environment and can write reports to an unrestricted output path.

Review this before installing. Use a virtual environment instead of system Python, avoid --break-system-packages, set OUTPUT_FILE only to a safe workspace filename, and check whether you are comfortable with the mandatory branding and the missing DOCX export.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:127
Finding: Mandatory Third-Party Branding in Generated Research Reports
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:45
Finding: Unpinned Dependency Installation Bypasses System Package Protections
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:79
Finding: Unvalidated Output Path Can Overwrite Files Outside the Intended Directory
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description states that the skill provides '.md and .docx export' as part of its capabilities. However, the implementation only computes a .docx filename variable and the actual workflow saves only OUTFILE_MD, explicitly telling the user to use another skill to convert the markdown to Word format.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to write a file to a user-influenced path (OUTPUT_FILE-derived OUTFILE_MD) without warning about file creation or overwrite behavior. In agent environments with file tools, this can lead to unintended overwriting of existing files or silent creation of files in unexpected locations, especially because the skill frames the write as automatic after report generation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The setup code defines both markdown and DOCX output filenames, which supports the surrounding documentation's claim of dual-format export. Later, the wrap-up comment and status text state that only the markdown report is saved and that DOCX requires a separate skill, contradicting the apparent intent conveyed earlier in the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.