semfind

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:31 PM UTC
• Version: 0.1.2

Overview

This skill is a straightforward local semantic-search helper, with disclosed model/cache behavior and no evidence of hidden persistence or malicious actions.

Install in a virtual environment, avoid `sudo pip install`, and review or pin the `semfind` package version if you need strict supply-chain control. Use `--no-cache` or clear `~/.cache/semfind/` if you do not want embeddings of selected local files retained between runs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 3 and 20–24
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

The skill instructs users to install a package directly from the configured Python package index without specifying a reviewed version, cryptographic hashes, or a verified source.

Complete Code Snippet:

markdown

description: Semantic search over local text files using embeddings. Use when grep/ripgrep fails to find relevant results because the exact wording is unknown, or when searching by meaning rather than pattern — e.g., searching logs for "deployment issue" when the actual text says "container build failed". Install with `pip install semfind`.

markdown

## Install

```bash
pip install semfind

text

### Technical Analysis

Running `pip install semfind` resolves and installs the package version currently selected by the configured package index, together with its transitive dependencies. The instruction does not constrain resolution to an audited version, require package hashes, identify an authoritative source repository, or provide a lock file.

Python package installation may execute package-controlled build logic. Consequently, compromise of the package, one of its dependencies, or the package distribution account could turn this documented installation step into arbitrary code execution. The reviewed file does not itself contain a malicious payload; the risk arises from trusting mutable external supply-chain content.

### Attack Path

1. An attacker compromises the `semfind` distribution, its publisher account, or a transitive dependency, or causes the installer to use a malicious package index.
2. The attacker publishes a package release containing malicious installation, build, or runtime behavior.
3. A user or agent follows the documented `pip install semfind` instruction.
4. `pip` resolves the attacker-controlled release bec
...[truncated 686 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin semfind to a specifically reviewed release rather than installing the latest available version.
2. Supply a hash-locked requirements file and install it with pip install --require-hashes -r requirements.txt.
3. Lock and review all transitive dependencies using an appropriate dependency-management tool.
4. Document the authoritative package index and source repository, and verify release provenance or signatures where available.
5. Recommend installation inside a dedicated virtual environment or similarly isolated environment without administrative privileges.
6. Periodically scan pinned packages for known vulnerabilities and update them through a controlled review process.
7. Avoid sudo pip install and explicitly warn users that installation should occur with least privilege.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

text

file.md:9: [2026-01-15] Fixed docker build with missing env vars  (0.796)
file.md:3: [2026-01-17] Agent couldn't write to /var/log          (0.689)

Higher scores (closer to 1.0) mean stronger semantic match.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill does disclose later that the first run downloads a model and writes caches locally, but that warning is omitted from the top-level skill description users may rely on before invocation. This can surprise users in restricted or sensitive environments by causing unintended network access and local filesystem writes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.