ai-workflow-engine

• Outcome: Review
• Latest audit: May 28, 2026 · 1:16 PM UTC
• Version: 1.0.0

Overview

This looks like a legitimate AI workflow automation skill, but it needs Review because it imports undeclared local code and exposes broad network, file, database, webhook, and model-provider actions without enough scoping guidance.

Install only if you can review workflows before running them. Use a sandbox or test data first, avoid production databases and real email/webhook targets until validated, keep credentials in environment variables or a secret manager, pin dependencies, and remove or review the hard-coded local skill imports before trusting it in a sensitive environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (14)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill explicitly demonstrates workflows that scrape websites, clean data, write to databases, generate reports, and send email, but it provides no safety guidance, consent requirements, or warnings about side effects on user data and external systems. In an agent skill, these omissions increase the risk that a user or downstream agent will trigger actions with real-world consequences without understanding data handling, authorization, or outbound communication risks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The Agent, RAG, and code-generation sections normalize autonomous tool use such as reading files, writing files, querying the web, generating code, and sending email, yet they omit any warning about approval boundaries, data exfiltration, or unsafe generated code execution. Because this section encourages automatic fallback to tools and full workflow generation, the context makes the omission more dangerous: it could lead to unsupervised actions across local and external systems.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
requests
openai
anthropic

• Confidence: 98% confidence
• Finding: The dependency list is completely unpinned, so builds can resolve to different versions over time, including newly introduced vulnerable or breaking releases. In a security-sensitive agent skill that processes external data and uses network/LLM libraries, this weakens supply-chain integrity and makes incident reproduction difficult.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
requests
openai
anthropic
chromadb

• Confidence: 98% confidence
• Finding: The requests package is unpinned, which allows unpredictable upgrades or dependency resolution drift that may pull in vulnerable versions. Because this library handles outbound HTTP, version uncertainty can directly affect transport security and credential-handling behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
requests
openai
anthropic
chromadb
pypdf

• Confidence: 97% confidence
• Finding: Leaving the openai SDK unpinned creates supply-chain risk and non-reproducible environments, especially for software that depends on API client behavior for authentication and data handling. Even without a cited CVE here, unpinned dependencies are a real security weakness because they can silently change at install time.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas
requests
openai
anthropic
chromadb
pypdf
beautifulsoup4

• Confidence: 98% confidence
• Finding: The anthropic SDK is unpinned, so installations may resolve to inconsistent versions, including versions with known defects or future insecure defaults. In an agent skill using model APIs, dependency drift can affect authentication, file handling, or tool integration behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests
openai
anthropic
chromadb
pypdf
beautifulsoup4
lxml

• Confidence: 98% confidence
• Finding: chromadb is unpinned, introducing supply-chain and reproducibility risk in a component that may store or retrieve model context and embeddings. If a vulnerable or incompatible version is pulled, it could affect data confidentiality or service stability.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

openai
anthropic
chromadb
pypdf
beautifulsoup4
lxml

• Confidence: 99% confidence
• Finding: pypdf is unpinned despite being a parser for attacker-controlled document content, making version drift especially risky. Unpinned parser libraries can expose the application to denial-of-service or parsing vulnerabilities as package resolution changes.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

anthropic
chromadb
pypdf
beautifulsoup4
lxml

• Confidence: 98% confidence
• Finding: beautifulsoup4 is unpinned, which creates avoidable supply-chain uncertainty for HTML/XML parsing functionality. In software that may ingest untrusted web content, reproducible and reviewed parser versions are important to reduce exposure to parsing-related issues.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

chromadb
pypdf
beautifulsoup4
lxml

• Confidence: 99% confidence
• Finding: lxml is unpinned and is a high-risk parsing dependency because it commonly processes untrusted HTML/XML content. Allowing arbitrary version resolution increases exposure to known parser and sanitizer vulnerabilities and makes remediation inconsistent across deployments.

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High

• Category: Supply Chain
• Confidence: 94% confidence
• Finding: The requirements file permits installation of requests versions with multiple known advisories, including credential leakage and TLS/verification-related issues. Since requests is a core HTTP client and agent skills often contact remote services with secrets or tokens, using a vulnerable version could expose credentials, weaken request integrity, or leak sensitive data.

Known Vulnerable Dependency: anthropic — 2 advisory(ies): CVE-2026-34450 (Claude SDK for Python has Insecure Default File Permissions in Local Filesystem ); CVE-2026-34452 (Claude SDK for Python: Memory Tool Path Validation Race Condition Allows Sandbox)

Low

• Category: Supply Chain
• Confidence: 72% confidence
• Finding: The anthropic package is flagged with known advisories, and because the dependency is unpinned, vulnerable versions may be installed. The listed issues appear lower severity and may depend on specific local filesystem or sandboxed tool features, but in an agent context those features can still matter if the SDK interacts with local files or tool execution.

Known Vulnerable Dependency: pypdf — 10 advisory(ies): CVE-2026-24688 (pypdf has possible Infinite Loop when processing outlines/bookmarks); CVE-2026-27628 (pypdf has a possible infinite loop when loading circular /Prev entries in cross-); CVE-2026-40260 (pypdf: Manipulated XMP metadata entity declarations can exhaust RAM) +7 more

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: pypdf is a document parser, and the advisories listed include infinite-loop and resource-exhaustion conditions that are relevant when handling untrusted PDFs. In an agent skill, parser hangs or memory exhaustion can be triggered by malicious input and lead to denial of service or degraded availability.

Known Vulnerable Dependency: lxml — 10 advisory(ies): CVE-2021-43818 (lxml's HTML Cleaner allows crafted and SVG embedded scripts to pass through); CVE-2014-3146 (lxml Cross-site Scripting Via Control Characters); CVE-2021-28957 (lxml vulnerable to Cross-Site Scripting ) +7 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: lxml has multiple known advisories, including sanitizer/cleaner bypasses and XSS-related issues, and this file allows potentially vulnerable versions to be installed. In a skill that may parse or clean untrusted HTML/XML, these flaws can enable script injection, unsafe content handling, or parser abuse, making the dependency particularly dangerous in context.

Static analysis

No suspicious patterns detected.