Crunch Compete

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:41 PM UTC
• Version: 0.1.2

Overview

This is a coherent Crunch competition helper, with expected cautions around installing Python packages and handling a project submission token.

Install only in the documented virtual environment, review package names before allowing installs, avoid exposing real Crunch tokens in shared terminals or logs, and use quickstarter --overwrite only when you are comfortable replacing local files.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69

Finding

Unpinned Third-Party Packages Are Installed from PyPI

Content

View full analysis

cd ~/.crunch/workspace/competitions/ python -m venv .venv && source .venv/bin/activate pip install crunch-cli jupyter ipykernel --upgrade --quiet --progress-bar=off ``` The competition setup reference also installs competition-specific dependencies without version or integrity constraints: ```bash pip install crunch-cli crunch-synth jupyter ipykernel --upgrade --quiet --progress-bar=off ``` It permits further packages to be selected from external competition documentation: ```markdown Some competitions have their own SDK. Install in step 2: | Competition | Additional Package | |-------------|-------------------| | Synth | `crunch-synth` | | Falcon | `birdgame` | Check the competition's repo README.md for required packages. ``` ### Technical Analysis The installation commands do not pin package versions and do not verify package hashes. The `--upgrade` option explicitly instructs `pip` to select newer available releases rather than a previously reviewed version. Package installation can execute package-controlled build and installation logic with the privileges of the user running the skill. The skill reduces some risk by requiring a virtual environment and limiting normal installations to packages listed in the documentation or competition materials. A virtual environment, however, isolates Python dependencies rather than operating-system privileges: installation hooks still execute as the current user and can access that user's files, credentials, network connections, and writable configuration. The instruction to consult externa ...[truncated 1733 chars]

Remediation

View remediation

`. 2. Maintain a lock file containing all direct and transitive dependencies. 3. Generate and verify cryptographic hashes, and install with `pip --require-hashes`. 4. Remove `--upgrade` from routine setup commands. Upgrades should occur through a separate review and lock-file update process. 5. Maintain an explicit allowlist of reviewed package names and versions within the audited project rather than trusting arbitrary external `PACKAGES.md` or README content. 6. Require explicit user confirmation before installing any package absent from the reviewed lock file. 7. Consider downloading and scanning artifacts in a restricted environment before installation. 8. Run installation with minimal user privileges and without unnecessary credentials in the environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:34

Finding

Submission Token Is Passed Through a Command-Line Argument

Content

View full analysis

/submit`), and copies their token - **How it's used:** Passed once via `--token ` during `crunch setup` - **Persistence:** After setup, the CLI stores the token in the project's `.crunch/` config directory. All subsequent commands (`crunch test`, `crunch push`, `crunch download`) authenticate automatically — no need to pass the token again - **If token expires:** Run `crunch update-token` inside the project directory to refresh it **Agent rules for tokens:** - **Always ask the user** to provide the token — never assume, guess, or reuse tokens from other projects - **Never write tokens** into source files, scripts, notebooks, or any committed file - **Never log or echo tokens** in shell output (use `--token ` placeholder in examples shown to user) - Tokens are user-specific and project-scoped — each `crunch setup` call requires the user to supply one ``` The documented command is: ```bash # Get token from: https://hub.crunchdao.com/competitions//submit crunch setup --token ``` ### Technical Analysis The documentation correctly says that tokens must not be logged or written into committed files. Nevertheless, passing the real token as the value of `--token` places the credential in the process argument vector. Depending on the operating system, shell, execution environment, and agent infrastructure, command-line arguments may be exposed through: - Shel ...[truncated 2225 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/cli-reference.md (reported line 33)May include surrounding context.

md

| `crunch quickstarter` | Interactive quickstarter selection |
| `crunch quickstarter --name "Name"` | Deploy specific quickstarter |
| `crunch quickstarter --show-notebook` | Include notebook quickstarters |
| `crunch quickstarter --overwrite` | Overwrite existing files |

## Testing Commands

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

Each competition needs its own virtual environment (dependencies can conflict).

bash

mkdir -p ~/.crunch/workspace/competitions/<competition>
cd ~/.crunch/workspace/competitions/<competition>
python -m venv .venv && source .venv/bin/activate 
pip install crunch-cli jupyter ipykernel --upgrade --quiet --progress-bar=off

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The setup examples require --token <TOKEN>, which involves handling sensitive credentials, but the documentation does not warn users not to paste secrets into shared shells, logs, or command histories. For markdown files, omissions around privacy-sensitive behavior are in scope when credentials or sensitive data are involved.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file documents crunch quickstarter --overwrite, which implies replacing existing files, but the description only says 'Overwrite existing files' and does not warn users about potential loss of local changes or irreversible replacement. For markdown files, user-facing documentation should disclose behaviors that can affect user data or system integrity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/competition-setup.md (reported line 11)May include surrounding context.

bash

# 1. Create workspace and venv
mkdir -p ~/.crunch/workspace/competitions/<competition>
cd ~/.crunch/workspace/competitions/<competition>
python -m venv .venv

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/competition-setup.md (reported line 44)May include surrounding context.

Example: Synth Setup

bash

mkdir -p ~/.crunch/workspace/competitions/synth
cd ~/.crunch/workspace/competitions/synth
python -m venv .venv
source .venv/bin/activate

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

crunch update-token clearly relates to updating a project clone token, but the reference provides no warning that this operation involves sensitive authentication material. Users should be informed of credential sensitivity and any privacy implications when using such commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.