Liquid Neural Networks (LNN)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:23 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent LNN training utility with disclosed local scripts and no evidence of hidden persistence, exfiltration, or destructive behavior.

Install it in a virtual environment, review or pin the Python dependencies before use, and only train on CSV files you trust. Avoid running pip as an administrator. The skill itself appears locally scoped and purpose-aligned.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/requirements.txt:3

Finding

Unbounded Third-Party Dependency Resolution

Content

View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:3-8
Additional Locations: SKILL.md:65, README.md:27, references/api_cheatsheet.md:8-10
Vulnerability Type: Mutable and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

text

ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):
matplotlib>=3.7.0

The project instructs users to install these dependencies directly:

bash

pip install -r scripts/requirements.txt

The API reference also presents an entirely unconstrained installation command:

bash

pip install ncps torch numpy pandas

Technical Analysis

The dependency manifest specifies only minimum versions. It does not pin reviewed releases, impose upper bounds, provide cryptographic hashes, or include a lock file. Consequently, installation results can change over time as package indexes publish newer versions.

If an allowed upstream release or its distribution channel is compromised, pip may resolve and install the affected release without any change to this repository. Malicious package behavior could run through build or installation mechanisms and later when the dependency is imported by the scripts.

The package names appear to be ordinary PyPI project names; the audit found no evidence that the repository intentionally references a typosquatted package or attacker-controlled index. The risk arises from mutable and unverified dependency resolution rather than a confirmed malicious dependency.

Attack Path

1. An upstream dependency account, release process, build pipeline, or package-index distribution channel is compromised.
2. A malicious release is published with a version satisfying one of the lower-bound-only constraints.
3. A user follows the documented pip install command.
4. The resolver selects the newer malicious release b ...[truncated 824 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every runtime dependency to a reviewed exact version rather than using minimum-version constraints.
2. Generate and commit a lock file appropriate for the supported platforms and Python versions.
3. Require cryptographic package hashes, such as a hash-locked requirements file installed with pip install --require-hashes.
4. Use a trusted, explicitly configured package index or an internally controlled package mirror.
5. Separate optional visualization dependencies such as matplotlib from the core runtime dependency set.
6. Add automated dependency vulnerability and integrity scanning to the release process.
7. Replace the unconstrained command in references/api_cheatsheet.md with the same reviewed, hash-verified installation procedure used by the project.
8. Periodically update pinned versions through a controlled review and testing process rather than allowing automatic selection of future releases.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

pip install -r scripts/requirements.txt

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 148)May include surrounding context.

md

pip install -r scripts/requirements.txt

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/train_lnn.py (reported line 210)May include surrounding context.

python

def train(model, hidden_size, Xtr, Ytr, Xva, Yva, device, args, log_every=100):
    torch = __import__("torch")
    from torch import nn
    torch.manual_seed(args.seed)
    model = model.to(device)

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/train_lnn.py (reported line 241)May include surrounding context.

python

def train(model, hidden_size, Xtr, Ytr, Xva, Yva, device, args, log_every=100):
    torch = __import__("torch")
    from torch import nn
    torch.manual_seed(args.seed)
    model = model.to(device)

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 75% confidence

Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · scripts/train_lnn.py (reported line 259)May include surrounding context.

python

def train(model, hidden_size, Xtr, Ytr, Xva, Yva, device, args, log_every=100):
    torch = __import__("torch")
    from torch import nn
    torch.manual_seed(args.seed)
    model = model.to(device)

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest description includes both English and Chinese content as a fixed presentation choice rather than offering localization based on user preference. Under the language/locale policy rule, mandating a specific language or locale behavior without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with only a lower bound, so installs may resolve to different future versions with different security properties and behavior. This weakens build reproducibility and makes it harder to verify whether a deployed environment includes a vulnerable or incompatible release.

Content

Scanner excerpt · scripts/requirements.txt (reported line 3)May include surrounding context.

text

# Liquid Neural Network (LNN) Skill - Python dependencies
# Python 3.9+ recommended.
ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

PyTorch is unpinned, allowing environments to install arbitrary newer releases that may introduce known vulnerabilities or unsafe deserialization behavior differences. In an ML training skill, this is more sensitive because PyTorch commonly handles model files and complex native code, increasing the consequences of landing on a bad version.

Content

Scanner excerpt · scripts/requirements.txt (reported line 4)May include surrounding context.

text

# Liquid Neural Network (LNN) Skill - Python dependencies
# Python 3.9+ recommended.
ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):

Unverifiable Dependency: torch has 16 known advisory(ies) (CVE-2025-2953 (PyTorch susceptible to local Denial of Service); CVE-2022-45907 (PyTorch vulnerable to arbitrary code execution); CVE-2025-32434 (PyTorch: `torch.load` with `weights_only=True` leads to remote code execution) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Because torch is not pinned, it is impossible to verify whether installations will avoid versions affected by known advisories, including serious issues around model loading and denial of service. The skill context increases concern because ML workflows often download or load model artifacts, where unsafe framework versions can materially expand exploitation risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

An unpinned NumPy version creates non-reproducible installs and prevents clear determination of whether a given deployment is affected by package-specific vulnerabilities. While NumPy is foundational, the direct exploitability here is typically lower than packages that deserialize complex untrusted objects.

Content

Scanner excerpt · scripts/requirements.txt (reported line 5)May include surrounding context.

text

# Python 3.9+ recommended.
ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):
matplotlib>=3.7.0

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The unpinned NumPy dependency makes advisory exposure unverifiable across deployments, so some installs could resolve to versions with known issues. Although NumPy is usually less directly exposed than framework/model-loading components, uncertainty around deployed versions is still a supply-chain weakness.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

Pandas is declared with only a minimum version, so future installs may pull different releases with unknown security status and behavior. This matters in a CSV-processing training utility because data ingestion libraries are part of the attack surface when handling untrusted files.

Content

Scanner excerpt · scripts/requirements.txt (reported line 6)May include surrounding context.

text

ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):
matplotlib>=3.7.0

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

Since pandas is not pinned, there is no assurance that deployments avoid versions with known advisories, especially in environments that process CSV inputs from untrusted sources. The context modestly increases relevance because data-parsing libraries are part of the file-ingestion surface in this skill.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Even though matplotlib is optional, leaving it unpinned still permits non-reproducible installs and uncertain exposure to future package issues. Optional dependencies can still become part of the runtime attack surface when users enable drawing or visualization features.

Content

Scanner excerpt · scripts/requirements.txt (reported line 8)May include surrounding context.

text

numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):
matplotlib>=3.7.0

Static analysis

No suspicious patterns detected.