Unit

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:20 AM UTC
• Version: 1.0.1

Overview

This is a disclosed unit-conversion skill with ordinary local script execution and live currency-rate lookup, with some install and cache safety caveats.

Before installing, use an isolated virtual environment, avoid running pip as an administrator, consider pinning requests, and expect currency conversions to contact exchangerate.host and write a small cache file under the user's home directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unbounded Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:1 and SKILL.md:119-123
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable code:

requirements.txt:1

text

requests>=2.25.0

SKILL.md:119-123

bash

pip install requests

Technical Analysis

The project permits any current or future version of requests newer than or equal to 2.25.0. The installation instructions similarly install the latest version available from pip's configured package index. Neither approach pins a reviewed version, verifies package hashes, or locks transitive dependencies.

Consequently, the dependency graph and installation behavior can change without any modification to this project. Exploitation requires compromise of an accepted package release, one of its transitive dependencies, or the package index or mirror used by the victim. There is no evidence that the currently referenced requests package is malicious; the issue is the absence of dependency integrity and reproducibility controls.

Attack Path

1. An attacker compromises a future accepted release of requests, a transitive dependency, or a package source used by the victim.
2. A user follows the documented pip install requests instruction or installs from requirements.txt.
3. pip resolves and downloads the compromised version because the version range has no upper bound and no hashes are enforced.
4. Malicious installation or runtime behavior executes with the privileges of the user or environment performing the installation or running the converter.

Impact Assessment

Successful exploitation could execute arbitrary code within the installation or runtime environment. The resulting privileges are limited to those of the account or container running pip or the Skill, but could include access to that account's files, environment variables, network credentials, and application data. If installa ...[truncated 91 chars]

Remediation

View remediation

Remediation Suggestions

• Pin requests and all transitive dependencies to specifically reviewed versions.
• Generate and commit a lock file appropriate to the project's package-management workflow.
• Require package hashes during installation, such as through a fully hashed requirements file and pip install --require-hashes.
• Install dependencies from a trusted package index over authenticated TLS and restrict unapproved mirrors.
• Use an isolated virtual environment and avoid installing the Skill with administrative privileges.
• Add automated dependency vulnerability and provenance checks to the release process.
• Update SKILL.md so its installation command uses the reviewed, locked dependency file rather than installing an unconstrained latest release.

T09 · Insecure Skill Coding Practices

Warning

• Location: unit_converter.py:416

Finding

Predictable Cache Path Permits Symbolic-Link File Overwrite

Content

View full analysis

Vulnerability Details

File Location: unit_converter.py:25 and unit_converter.py:416-417
Vulnerability Type: Unsafe cache-file creation and symbolic-link following
Risk Level: Medium

Vulnerable code:

unit_converter.py:25

python

self.cache_file = Path.home() / ".unit_converter_cache.json"

unit_converter.py:416-417

python

with open(self.cache_file, 'w') as f:
    json.dump(data, f)

Technical Analysis

Currency responses are cached at a fixed and predictable path in the user's home directory. The file is opened in write mode without rejecting symbolic links, exclusively creating the destination, validating file ownership and type, or first writing to a securely created temporary file.

Python's normal open(..., 'w') operation follows a symbolic link and truncates its target. An attacker who can create or replace ~/.unit_converter_cache.json can therefore redirect the cache write to another file writable by the converter's user. Exploitation is constrained by filesystem permissions: the Skill does not independently bypass access controls, and the attacker must already be able to manipulate the cache pathname or its containing directory.

Attack Path

1. A local attacker gains the ability to create or replace ~/.unit_converter_cache.json, such as through an improperly shared or writable home directory.
2. The attacker creates that path as a symbolic link to another file writable by the victim account.
3. The victim invokes a currency conversion after the cache has expired or when no valid cache exists.
4. The Skill retrieves exchange-rate JSON from the remote API.
5. open(self.cache_file, 'w') follows the symbolic link and truncates the linked target.
6. json.dump(data, f) writes the API response into the target file, corrupting or replacing its prior contents.

Impact Assessment

The issue can overwrite or corrupt an arbitrary file writable by the acco ...[truncated 447 chars]

Remediation

View remediation

Remediation Suggestions

• Store the cache under a dedicated per-user cache directory with permissions restricted to the current user.
• Verify that the cache destination is a regular file owned by the expected user and reject symbolic links.
• On supported systems, open files using low-level flags such as O_NOFOLLOW, and use restrictive permissions such as 0600.
• Create a temporary file securely and exclusively in the same directory, write and flush the JSON, and atomically replace the final cache file.
• Validate the ownership and permissions of the containing directory before writing.
• Avoid check-then-open logic as the sole defense because it remains susceptible to time-of-check/time-of-use races.
• Treat cache-write failures as nonfatal where possible, allowing conversion to complete without placing user files at risk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md

- **脚本找不到**：确保 `unit/unit_converter.py` 文件与 `SKILL.md` 在同一目录（即 `.opencode/skills/unit/` 下）。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill instructs the agent to execute a local Python script, potentially install a dependency with pip, and perform live network requests for currency conversion, but it declares no explicit tool scope or permission boundaries. This can cause the agent to use filesystem and network capabilities implicitly, increasing the chance of unintended code execution, dependency installation, or outbound access beyond what a user expects from a simple conversion skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation rule says the agent should use this skill for any unit conversion request, which is overly broad and lacks exclusions or precedence rules. Overbroad activation can trigger unnecessary script execution or network access in cases where a simple built-in answer would suffice, expanding the attack surface and making tool use less predictable.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The skill directs the agent to send currency-related query data to an external service to retrieve exchange rates. Even if the transmitted data is limited, outbound requests introduce privacy, integrity, and supply-chain risk because results depend on a third-party endpoint and user prompts may influence request parameters.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

text

   目标值 = 输入值 × (源单位系数) / (目标单位系数)

3. 货币：必须联网调用 API。如果脚本失败，可尝试直接使用 requests 调用 https://api.exchangerate.host/latest?base=<源货币> 获取汇率并计算。

温度转换公式（备用）

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The skill sends user-supplied currency conversion requests to an external third-party service, which creates a data egress channel and a dependency on remote content. In an agent context, even seemingly harmless requests can leak usage patterns or sensitive financial intents, and the unpinned external response can influence output integrity if the service is unavailable, compromised, or manipulated.

Content

Scanner excerpt · unit_converter.py (reported line 415)May include surrounding context.

python

pass  # ignore cache errors

        # Fetch fresh data
        url = f"https://api.exchangerate.host/latest?base={base_currency.upper()}"
        try:
            response = requests.get(url, timeout=10)
            response.raise_for_status()

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file presents its available-units output entirely in Chinese labels and descriptions, such as category names and the currency note, without any opt-in or alternative locale selection. This creates a language/locale policy concern because the skill imposes a specific language on users rather than offering a choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The command description, examples heading, and runtime error message include Chinese-only user-facing text, but the skill does not document a locale constraint or let the user select their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency is specified as requests>=2.25.0, which allows installation of many future versions without reproducibility or review. This increases supply-chain risk and makes it impossible to guarantee that a known-good, patched version will be used across environments.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

requests>=2.25.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Because requests is unpinned, the manifest does not establish whether the installed version includes fixes for known advisories affecting some releases. In a skill that may call external services for currency conversion, an outdated or vulnerable HTTP client could expose credentials, mishandle TLS/session behavior, or otherwise weaken network security.

Content

No source excerpt is available for this finding.