Unit

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:20 AM UTC
• Version: 1.0.1

Overview

This is a disclosed unit-conversion skill with ordinary local script execution and live currency-rate lookup, with some install and cache safety caveats.

Before installing, use an isolated virtual environment, avoid running pip as an administrator, consider pinning requests, and expect currency conversions to contact exchangerate.host and write a small cache file under the user's home directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1
• Finding: Unbounded Third-Party Dependency Installation## Vulnerability Details **File Location**: `requirements.txt:1` and `SKILL.md:119-123` **Vulnerability Type**: Unpinned third-party dependency **Risk Level**: Medium **Vulnerable code:** `requirements.txt:1` ```text requests>=2.25.0 ``` `SKILL.md:119-123` ```bash pip install requests ``` ### Technical Analysis The project permits any current or future version of `requests` newer than or equal to 2.25.0. The installation instructions similarly install the latest version available from pip's configured package index. Neither approach pins a reviewed version, verifies package hashes, or locks transitive dependencies. Consequently, the dependency graph and installation behavior can change without any modification to this project. Exploitation requires compromise of an accepted package release, one of its transitive dependencies, or the package index or mirror used by the victim. There is no evidence that the currently referenced `requests` package is malicious; the issue is the absence of dependency integrity and reproducibility controls. ### Attack Path 1. An attacker compromises a future accepted release of `requests`, a transitive dependency, or a package source used by the victim. 2. A user follows the documented `pip install requests` instruction or installs from `requirements.txt`. 3. pip resolves and downloads the compromised version because the version range has no upper bound and no hashes are enforced. 4. Malicious installation or runtime behavior executes with the privileges of the user or environment performing the installation or running the converter. ### Impact Assessment Successful exploitation could execute arbitrary code within the installation or runtime environment. The resulting privileges are limited to those of the account or container running pip or the Skill, but could include access to that account's files, environment variables, network credentials, and application data. If installa ...[truncated 91 chars]
• Remediation: ## Remediation Suggestions - Pin `requests` and all transitive dependencies to specifically reviewed versions. - Generate and commit a lock file appropriate to the project's package-management workflow. - Require package hashes during installation, such as through a fully hashed requirements file and `pip install --require-hashes`. - Install dependencies from a trusted package index over authenticated TLS and restrict unapproved mirrors. - Use an isolated virtual environment and avoid installing the Skill with administrative privileges. - Add automated dependency vulnerability and provenance checks to the release process. - Update `SKILL.md` so its installation command uses the reviewed, locked dependency file rather than installing an unconstrained latest release.

T09 · Insecure Skill Coding Practices

Warning

• Location: unit_converter.py:416
• Finding: Predictable Cache Path Permits Symbolic-Link File Overwrite## Vulnerability Details **File Location**: `unit_converter.py:25` and `unit_converter.py:416-417` **Vulnerability Type**: Unsafe cache-file creation and symbolic-link following **Risk Level**: Medium **Vulnerable code:** `unit_converter.py:25` ```python self.cache_file = Path.home() / ".unit_converter_cache.json" ``` `unit_converter.py:416-417` ```python with open(self.cache_file, 'w') as f: json.dump(data, f) ``` ### Technical Analysis Currency responses are cached at a fixed and predictable path in the user's home directory. The file is opened in write mode without rejecting symbolic links, exclusively creating the destination, validating file ownership and type, or first writing to a securely created temporary file. Python's normal `open(..., 'w')` operation follows a symbolic link and truncates its target. An attacker who can create or replace `~/.unit_converter_cache.json` can therefore redirect the cache write to another file writable by the converter's user. Exploitation is constrained by filesystem permissions: the Skill does not independently bypass access controls, and the attacker must already be able to manipulate the cache pathname or its containing directory. ### Attack Path 1. A local attacker gains the ability to create or replace `~/.unit_converter_cache.json`, such as through an improperly shared or writable home directory. 2. The attacker creates that path as a symbolic link to another file writable by the victim account. 3. The victim invokes a currency conversion after the cache has expired or when no valid cache exists. 4. The Skill retrieves exchange-rate JSON from the remote API. 5. `open(self.cache_file, 'w')` follows the symbolic link and truncates the linked target. 6. `json.dump(data, f)` writes the API response into the target file, corrupting or replacing its prior contents. ### Impact Assessment The issue can overwrite or corrupt an arbitrary file writable by the acco ...[truncated 447 chars]
• Remediation: ## Remediation Suggestions - Store the cache under a dedicated per-user cache directory with permissions restricted to the current user. - Verify that the cache destination is a regular file owned by the expected user and reject symbolic links. - On supported systems, open files using low-level flags such as `O_NOFOLLOW`, and use restrictive permissions such as `0600`. - Create a temporary file securely and exclusively in the same directory, write and flush the JSON, and atomically replace the final cache file. - Validate the ownership and permissions of the containing directory before writing. - Avoid check-then-open logic as the sole defense because it remains susceptible to time-of-check/time-of-use races. - Treat cache-write failures as nonfatal where possible, allowing conversion to complete without placing user files at risk.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Ae1

High

• Category: analysis-evasion

Content

- **脚本找不到**：确保 `unit/unit_converter.py` 文件与 `SKILL.md` 在同一目录（即 `.opencode/skills/unit/` 下）。

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs the agent to execute a local Python script, potentially install a dependency with pip, and perform live network requests for currency conversion, but it declares no explicit tool scope or permission boundaries. This can cause the agent to use filesystem and network capabilities implicitly, increasing the chance of unintended code execution, dependency installation, or outbound access beyond what a user expects from a simple conversion skill.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The activation rule says the agent should use this skill for any unit conversion request, which is overly broad and lacks exclusions or precedence rules. Overbroad activation can trigger unnecessary script execution or network access in cases where a simple built-in answer would suffice, expanding the attack surface and making tool use less predictable.

External Transmission

Medium

• Category: Data Exfiltration

Content

```
   目标值 = 输入值 × (源单位系数) / (目标单位系数)
   ```
3. **货币**：必须联网调用 API。如果脚本失败，可尝试直接使用 `requests` 调用 `https://api.exchangerate.host/latest?base=<源货币>` 获取汇率并计算。

## 温度转换公式（备用）

• Confidence: 83% confidence
• Finding: The skill directs the agent to send currency-related query data to an external service to retrieve exchange rates. Even if the transmitted data is limited, outbound requests introduce privacy, integrity, and supply-chain risk because results depend on a third-party endpoint and user prompts may influence request parameters.

External Transmission

Medium

• Category: Data Exfiltration

Content

pass  # ignore cache errors

        # Fetch fresh data
        url = f"https://api.exchangerate.host/latest?base={base_currency.upper()}"
        try:
            response = requests.get(url, timeout=10)
            response.raise_for_status()

• Confidence: 89% confidence
• Finding: The skill sends user-supplied currency conversion requests to an external third-party service, which creates a data egress channel and a dependency on remote content. In an agent context, even seemingly harmless requests can leak usage patterns or sensitive financial intents, and the unpinned external response can influence output integrity if the service is unavailable, compromised, or manipulated.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file presents its available-units output entirely in Chinese labels and descriptions, such as category names and the currency note, without any opt-in or alternative locale selection. This creates a language/locale policy concern because the skill imposes a specific language on users rather than offering a choice.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The command description, examples heading, and runtime error message include Chinese-only user-facing text, but the skill does not document a locale constraint or let the user select their preferred language. Under the policy, forcing a specific language without opt-in is a natural-language policy violation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.25.0

• Confidence: 96% confidence
• Finding: The dependency is specified as `requests>=2.25.0`, which allows installation of many future versions without reproducibility or review. This increases supply-chain risk and makes it impossible to guarantee that a known-good, patched version will be used across environments.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: Because `requests` is unpinned, the manifest does not establish whether the installed version includes fixes for known advisories affecting some releases. In a skill that may call external services for currency conversion, an outdated or vulnerable HTTP client could expose credentials, mishandle TLS/session behavior, or otherwise weaken network security.

Static analysis

No suspicious patterns detected.