Agent Lightning

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:06 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for agent training, but its install instructions rely on unpinned packages and an optional mixed TestPyPI/PyPI nightly install path that users should review carefully.

Install only in a virtual environment or container, prefer a pinned stable PyPI release over the nightly TestPyPI command, avoid exposing unnecessary API keys or cloud credentials during install and training, and review where checkpoints, logs, traces, and remote storage will be written.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party Package Installation from Multiple Package Indexes

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-42
Vulnerability Type: Unpinned dependency installation and unsafe package-index configuration
Risk Level: Medium

Vulnerable Code

bash

pip install agentlightning

For the latest nightly build:

bash

pip install --upgrade --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ --pre agentlightning

Technical Analysis

The installation instructions do not pin agentlightning to a reviewed version or verify package hashes. Consequently, the package content installed by users can change independently of the audited Skill.

The nightly installation command introduces additional supply-chain risk by:

• Allowing pre-release package versions through --pre.
• Using TestPyPI as a package source.
• Resolving packages across both TestPyPI and PyPI through --index-url and --extra-index-url.
• Omitting version constraints, integrity hashes, and provenance verification.

Python packages may execute installation or build logic during installation, and their modules execute code when imported. Therefore, compromise of the package, one of its dependencies, its publishing credentials, or the configured package indexes could result in execution of code not present in this reviewed repository.

Attack Path

1. An attacker compromises a relevant package publisher account or publishes a malicious package version that is eligible for resolution from one of the configured indexes.
2. A user follows the documented unpinned installation command.
3. The package resolver selects and downloads the attacker-controlled or compromised release.
4. Malicious build or installation logic executes during package installation, or malicious module code executes when the example imports agentlightning.
5. The payload runs with the privileges and environment access of the user performing installation or training.

...[truncated 632 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin agentlightning and all transitive dependencies to explicitly reviewed versions.
2. Use a hash-locked requirements file, for example with --require-hashes, so downloaded artifacts are cryptographically verified.
3. Prefer the official stable PyPI index and avoid TestPyPI for normal installation workflows.
4. If nightly packages are required, publish and document an exact trusted version rather than combining an unpinned package name with --pre.
5. Avoid mixed-index dependency resolution. Use a controlled internal mirror or install the exact intended artifact from one authenticated source.
6. Verify package provenance, release signatures, maintainers, and expected artifact hashes before updating pinned versions.
7. Install the dependency inside a dedicated virtual environment or container under a non-privileged account.
8. Prevent training environments from exposing unnecessary API keys, cloud credentials, sensitive datasets, or writable host paths during dependency installation.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill documents code usage patterns and capabilities that can read local files or logs, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a mismatch between apparent capability and declared restrictions, which can cause an agent runtime to grant broader access than a reviewer expects or make risk evaluation impossible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code saves training artifacts to disk via trainer.save("./trained-agent"), which is a file write operation. Although the script prints training status, it does not explicitly disclose that it will create or overwrite output directories/files, and the module docstring likewise omits this behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.