Talos Pro — Social Media Command Centre

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:06 AM UTC
• Version: 1.0.4

Overview

The skill is a local social media calendar generator, but its install step unnecessarily modifies the system Python environment with an unpinned package.

Review before installing. Prefer running this in a virtual environment and pinning dependencies instead of using the provided system-wide pip command. Also run it from a directory where you are comfortable storing generated marketing plans, because it writes export files there.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79

Finding

Unpinned Dependency Installation into the System Python Environment

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79-83
Vulnerability Type: Unpinned third-party dependency installation and unsafe modification of the system Python environment
Risk Level: Medium

Vulnerable Code

bash

pip3 install rich --break-system-packages --quiet

Technical Analysis

The installation instructions retrieve rich and its transitive dependencies from pip's configured package index without pinning an audited version or verifying package hashes. Consequently, the dependency graph can change after the Skill has been reviewed.

The use of --break-system-packages additionally bypasses protections for externally managed Python environments. Rather than isolating the Skill's dependencies, the command can install or replace packages in the user's system-managed Python environment. Installation hooks and imported package code execute with the privileges of the user running the command.

No evidence establishes that the current rich package is malicious. The vulnerability is the mutable, unverified supply-chain trust combined with an unnecessarily invasive installation method.

Attack Path

1. An attacker compromises the configured Python package index, the rich distribution, or one of its resolved dependencies.
2. The attacker publishes a malicious release or causes pip to resolve an attacker-controlled distribution.
3. A user follows the Skill's installation instructions.
4. pip3 downloads and installs the mutable dependency set without hash verification.
5. Malicious installation or runtime code executes with the privileges of the user invoking pip.
6. Because --break-system-packages permits changes to the externally managed environment, affected packages may also influence other Python applications using that environment.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the invoking user's privileges. This may permit ac ...[truncated 436 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --break-system-packages and install dependencies in a dedicated virtual environment.
2. Pin rich and every transitive dependency to reviewed versions.
3. Generate a lock file containing cryptographic hashes and install with hash enforcement, such as pip install --require-hashes -r requirements.txt.
4. Configure an explicit trusted package index rather than relying on arbitrary user-level pip configuration.
5. Build and test dependencies in a restricted environment before deployment.
6. Document the dependency versions and establish a controlled process for reviewing and updating them.
7. Where practical, package the Skill in an isolated container or another reproducible runtime environment.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The embedded Python code writes JSON, CSV, and Markdown files to the local filesystem automatically, but the skill documentation does not clearly warn users that running it will create persistent export files. Silent file creation is risky because users may execute the skill expecting console output only, and the generated files can unintentionally store sensitive business topics, planned content, or other environment-derived data on disk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.