Agent Lightning

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:06 PM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for agent training, but its install instructions rely on unpinned packages and an optional mixed TestPyPI/PyPI nightly install path that users should review carefully.

Install only in a virtual environment or container, prefer a pinned stable PyPI release over the nightly TestPyPI command, avoid exposing unnecessary API keys or cloud credentials during install and training, and review where checkpoints, logs, traces, and remote storage will be written.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37
• Finding: Unpinned Third-Party Package Installation from Multiple Package Indexes## Vulnerability Details **File Location**: `SKILL.md`, lines 37-42 **Vulnerability Type**: Unpinned dependency installation and unsafe package-index configuration **Risk Level**: Medium ### Vulnerable Code ```bash pip install agentlightning ``` For the latest nightly build: ```bash pip install --upgrade --index-url https://test.pypi.org/simple/ --extra-index-url https://pypi.org/simple/ --pre agentlightning ``` ### Technical Analysis The installation instructions do not pin `agentlightning` to a reviewed version or verify package hashes. Consequently, the package content installed by users can change independently of the audited Skill. The nightly installation command introduces additional supply-chain risk by: - Allowing pre-release package versions through `--pre`. - Using TestPyPI as a package source. - Resolving packages across both TestPyPI and PyPI through `--index-url` and `--extra-index-url`. - Omitting version constraints, integrity hashes, and provenance verification. Python packages may execute installation or build logic during installation, and their modules execute code when imported. Therefore, compromise of the package, one of its dependencies, its publishing credentials, or the configured package indexes could result in execution of code not present in this reviewed repository. ### Attack Path 1. An attacker compromises a relevant package publisher account or publishes a malicious package version that is eligible for resolution from one of the configured indexes. 2. A user follows the documented unpinned installation command. 3. The package resolver selects and downloads the attacker-controlled or compromised release. 4. Malicious build or installation logic executes during package installation, or malicious module code executes when the example imports `agentlightning`. 5. The payload runs with the privileges and environment access of the user performing installation or training. ...[truncated 632 chars]
• Remediation: ## Remediation Suggestions 1. Pin `agentlightning` and all transitive dependencies to explicitly reviewed versions. 2. Use a hash-locked requirements file, for example with `--require-hashes`, so downloaded artifacts are cryptographically verified. 3. Prefer the official stable PyPI index and avoid TestPyPI for normal installation workflows. 4. If nightly packages are required, publish and document an exact trusted version rather than combining an unpinned package name with `--pre`. 5. Avoid mixed-index dependency resolution. Use a controlled internal mirror or install the exact intended artifact from one authenticated source. 6. Verify package provenance, release signatures, maintainers, and expected artifact hashes before updating pinned versions. 7. Install the dependency inside a dedicated virtual environment or container under a non-privileged account. 8. Prevent training environments from exposing unnecessary API keys, cloud credentials, sensitive datasets, or writable host paths during dependency installation.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill documents code usage patterns and capabilities that can read local files or logs, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates a mismatch between apparent capability and declared restrictions, which can cause an agent runtime to grant broader access than a reviewer expects or make risk evaluation impossible.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This code saves training artifacts to disk via `trainer.save("./trained-agent")`, which is a file write operation. Although the script prints training status, it does not explicitly disclose that it will create or overwrite output directories/files, and the module docstring likewise omits this behavior.

Static analysis

No suspicious patterns detected.