Django REST Framework

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:01 PM UTC
• Version: 1.0.0

Overview

This is a straightforward Django REST Framework guidance skill with expected setup commands and no hidden or unrelated behavior.

Use this skill for Django REST Framework work. Run installation commands inside a virtual environment, avoid elevated privileges, and pin or hash-lock dependencies before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Dependencies Installed from an Implicit Package Index

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 35
Vulnerability Type: Insecure dependency installation and supply-chain exposure
Risk Level: Medium

Complete Code Snippet:

bash

pip install django djangorestframework

Technical Analysis

The Skill instructs users to install django and djangorestframework without pinning reviewed versions, validating package hashes, or explicitly identifying a trusted package repository. Pip will therefore select mutable package versions from whichever index is configured in the user's environment.

Installing these dependencies is necessary for the Skill's declared Django REST Framework scaffolding functionality, and both package names correspond to established projects. However, the instruction lacks standard dependency-integrity and reproducibility controls. If a package release, transitive dependency, configured package index, or package-distribution account is compromised, following the instruction could install attacker-controlled content.

The command does not explicitly transmit credentials, private keys, source code, environment variables, or other sensitive information. Therefore, the pre-scan warning concerning sensitive-information transmission is not substantiated by the reviewed content. The relevant confirmed risk is dependency supply-chain exposure.

Attack Path

1. An attacker compromises a selected package release, one of its transitive dependencies, its distribution account, or a package index configured in the user's pip environment.
2. A user follows the Skill and runs the unpinned installation command.
3. Pip resolves the current package artifacts using the implicit index and installs them without checking project-provided hashes.
4. A malicious artifact executes installation-related behavior where applicable or introduces malicious runtime code.
5. The malicious code subsequently runs with the privileges of the user executing pip ...[truncated 900 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the direct unpinned installation command with a reviewed requirements or lock file containing exact versions.
2. Generate and record cryptographic hashes for all direct and transitive dependencies, then install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

3. Document the expected trusted package index and avoid relying silently on user-specific pip configuration. Where appropriate, use an explicitly approved internal mirror.
4. Regularly review and update pinned versions to receive security fixes rather than leaving pins indefinitely stale.
5. Run dependency vulnerability scanning in CI using a maintained tool such as pip-audit.
6. Perform installation in an isolated virtual environment under a non-privileged account, as already partially encouraged by the Skill, and explicitly warn users not to run pip as root or with elevated privileges.
7. If a tutorial must permit flexible versions, specify reviewed compatible version ranges and explain that production deployments should use a fully resolved, hash-locked dependency set.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file defines when to use the skill, so SQP-1 applies. Phrases like "Work on a Django project that uses Django REST Framework" and "Add, modify, or apply best practices" are very broad and do not provide exclusion conditions or negative examples, which could cause the skill to be invoked for ordinary development work that only tangentially involves DRF.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.