Liquid Neural Networks (LNN)

• Outcome: Pass
• Latest audit: Aug 30, 2026 · 6:03 AM UTC
• Version: 1.0.0

Overview

This skill is a coherent local ML training helper with expected dependencies and user-directed file outputs.

Install this in a normal Python environment and review or pin dependency versions if reproducible builds matter. Only point --csv at data you intend to process locally, and use --save or --draw only when you want output files written.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Liquid Neural Network (LNN) Skill - Python dependencies
# Python 3.9+ recommended.
ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0

• Confidence: 97% confidence
• Finding: The dependency is specified with only a lower bound, which allows future installs to resolve to different versions over time. This creates supply-chain and reproducibility risk because a later release could introduce a security regression or breaking behavior without any change to this repository.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Liquid Neural Network (LNN) Skill - Python dependencies
# Python 3.9+ recommended.
ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):

• Confidence: 98% confidence
• Finding: Torch is a large, security-sensitive package and using only a minimum version allows installs to float to arbitrary later releases. In an ML skill that may load models and process external data, dependency drift increases exposure to supply-chain compromise, newly introduced vulnerabilities, and unreviewed behavior changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Python 3.9+ recommended.
ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):
matplotlib>=3.7.0

• Confidence: 95% confidence
• Finding: An unpinned numpy dependency permits non-reproducible environments and uncontrolled upgrades. While numpy itself is less obviously risky than model-loading frameworks, version drift can still introduce vulnerable transitive dependencies or unexpected runtime behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

ncps>=1.0.1
torch>=2.0.0
numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):
matplotlib>=3.7.0

• Confidence: 95% confidence
• Finding: Using pandas with only a lower bound allows future versions to be installed automatically, reducing build reproducibility and increasing supply-chain risk. Since this skill accepts CSV time-series data, parser behavior changes or future security issues in pandas could materially affect safety.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0
pandas>=2.0.0
# Optional (only needed for inspect_wiring.py --draw):
matplotlib>=3.7.0

• Confidence: 93% confidence
• Finding: Even though matplotlib is optional, an unpinned version still introduces avoidable supply-chain and reproducibility risk when the optional feature is used. Optional dependencies can become attack surface if users install extras without version controls.

Static analysis

No suspicious patterns detected.