Google MediaPipe

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.0.0

Overview

This is a documentation-only MediaPipe skill with expected install and model-download guidance, and no hidden or unrelated behavior found.

Install in a virtual environment or isolated project, pin package versions where practical, review lockfile changes, and expect outbound network access when installing packages or downloading MediaPipe model files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Note

• Location: SKILL.md:40
• Finding: Unpinned MediaPipe Python Dependency## Vulnerability Details **File Location**: `SKILL.md:40` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```bash pip install mediapipe ``` ### Technical Analysis The installation command does not pin `mediapipe` to a reviewed version and does not verify the package with a cryptographic hash. Consequently, the installed artifact depends on the package registry state at installation time. A future compromised, malicious, or unexpectedly incompatible release could therefore be installed without further review. Exploitation requires control over or compromise of the legitimate package distribution channel, publisher account, dependency chain, or selected release. There is no evidence that the named package is currently malicious. ### Attack Path 1. An attacker compromises the package publisher, registry distribution path, or a transitive dependency. 2. The attacker publishes a malicious release that satisfies the unbounded installation request. 3. A user follows the Skill instruction and runs `pip install mediapipe`. 4. pip downloads and installs the attacker-controlled artifact. 5. Malicious installation or runtime behavior executes with the permissions of the user or environment performing the installation. ### Impact Assessment Successful exploitation could execute code with the invoking user's privileges. Depending on that user's access, the payload could read or modify project files, access environment variables and user-readable credentials, tamper with the Python environment, or affect applications importing the package. The instruction does not request elevated privileges, so it does not independently provide administrator or root access.
• Remediation: ## Remediation Suggestions - Pin the dependency to an explicitly reviewed version, for example `mediapipe==0.10.35`. - Use a lockfile or fully hashed requirements file generated from reviewed artifacts. - Install with hash verification, such as `pip install --require-hashes -r requirements.txt`. - Configure an approved package index and prevent unintended fallback to untrusted registries. - Run dependency vulnerability and provenance checks before updating the pinned version. - Perform installation in an isolated virtual environment without elevated privileges.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:57
• Finding: Unpinned MediaPipe JavaScript Dependency## Vulnerability Details **File Location**: `SKILL.md:57` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```bash npm install @mediapipe/tasks-vision ``` ### Technical Analysis The npm command does not specify an exact reviewed package version or enforce a previously reviewed lockfile. Its effective contents may therefore change as new registry releases are published. npm packages may also define lifecycle scripts, making registry or publisher compromise a potential code-execution path during installation. Exploitation depends on compromise of the legitimate scoped package, its publisher, the npm distribution channel, or its dependency graph. The audit found no evidence that the referenced package is currently malicious. ### Attack Path 1. An attacker compromises the package publisher, npm distribution path, or a dependency selected during resolution. 2. A malicious version is published under a version accepted by the unpinned command. 3. A user runs the documented `npm install` command. 4. npm resolves and downloads the malicious artifact. 5. Malicious lifecycle code may run during installation, or malicious package code runs when the application imports it. ### Impact Assessment Exploitation could execute code with the privileges of the account running npm. This may permit access to project files, environment variables, user-readable credentials, build outputs, or other resources available to that account. The documented command does not itself elevate privileges or establish persistence.
• Remediation: ## Remediation Suggestions - Pin an exact reviewed package version rather than relying on the registry's current resolution. - Commit and review `package-lock.json`, then use `npm ci` for reproducible installation. - Retain npm integrity metadata and verify lockfile changes during code review. - Use an approved npm registry and restrict package publication and dependency-update permissions. - Consider disabling lifecycle scripts with `--ignore-scripts` where package functionality permits. - Run npm installation in a restricted, non-privileged build environment.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:277
• Finding: Unpinned MediaPipe Model Maker Dependency## Vulnerability Details **File Location**: `SKILL.md:277` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Low ### Vulnerable Code ```bash pip install mediapipe-model-maker ``` ### Technical Analysis This command installs the registry-selected version of `mediapipe-model-maker` without an exact version constraint or artifact hash. The resulting environment is not reproducible and may silently consume a future compromised or incompatible package release or transitive dependency. Exploitation requires compromise of the publisher, package registry, distribution path, or dependency chain. No evidence was found that the referenced package is currently malicious. ### Attack Path 1. An attacker obtains control of a relevant publisher account, distribution channel, or transitive dependency. 2. The attacker introduces a malicious release accepted by the unconstrained installation. 3. A user follows the Skill and executes `pip install mediapipe-model-maker`. 4. pip installs the affected package and its resolved dependencies. 5. Attacker-controlled behavior executes during installation or when Model Maker is imported or used. ### Impact Assessment Successful exploitation could run code under the installing user's account, exposing project data, training data, environment variables, user-readable secrets, and writable Python environment files. The scope is limited by the permissions and isolation of the installation environment; no separate privilege-escalation mechanism was identified.
• Remediation: ## Remediation Suggestions - Replace the unbounded command with an exact, reviewed version constraint. - Record all direct and transitive dependencies in a lockfile or hashed requirements file. - Require cryptographic hashes for downloaded wheels and source distributions. - Review dependency provenance and vulnerability reports before accepting updates. - Install inside a dedicated virtual environment or container using a non-privileged account. - Update dependencies through a controlled review process rather than automatically selecting the latest release.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: This markdown file explicitly instructs users to download models from `storage.googleapis.com`, which involves network access and data transfer, but it does not include any warning or disclosure about the network operation. Under the markdown criteria for SQP-2, behaviors that may affect privacy or system integrity should be disclosed to the user.

Static analysis

No suspicious patterns detected.