DXF to Image

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:30 PM UTC
• Version: 1.0.0

Overview

This skill is a straightforward DXF-to-image converter; its command execution and file output are disclosed and aligned with that purpose, though its Python dependencies should be pinned before higher-trust use.

Install this only in a virtual environment or similarly contained Python environment, avoid sudo/admin installs, and convert only DXF files you intended to share. The publisher should pin dependencies, ideally with a lockfile or hashes, before this is used in sensitive or automated workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: requirements.txt, lines 1–3
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

text

ezdxf
matplotlib
Pillow

The installation instruction that consumes this dependency file appears at SKILL.md, line 21:

text

pip install -r requirements.txt

Technical Analysis

All three dependencies are specified without exact versions or cryptographic hashes. Consequently, package installation resolves whatever releases are available from the configured package index at installation time.

This makes installations non-reproducible and prevents verification that users receive dependency artifacts reviewed or tested by the project author. If a dependency release, package-index account, distribution artifact, or configured package source is compromised, following the documented setup command can install attacker-controlled code.

The finding is limited to dependency pinning and integrity controls. The audited files contain no evidence that the named packages are currently malicious or that this project intentionally retrieves a malicious package.

Attack Path

1. An attacker compromises a listed dependency's publishing account, distribution process, or package source used by the victim.
2. The attacker publishes or substitutes a malicious release under the expected package name.
3. A user follows the setup instructions and runs pip install -r requirements.txt.
4. Because no version or hash restrictions are present, pip may resolve and install the malicious release.
5. Malicious package installation hooks or subsequently imported package code execute in the user's Python environment.
6. The payload acts with the privileges of the user performing installation or running the conversion script.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing or executing user's account. Depending on that account's permissions, ...[truncated 359 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin each dependency to an explicitly reviewed version using exact == constraints.

2. Generate and commit a lock file containing transitive dependencies rather than pinning only direct dependencies.

3. Record cryptographic hashes for every permitted distribution and install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Generate hashes and dependency locks through a controlled process, such as pip-tools, and review dependency changes before updating them.

5. Use a dedicated virtual environment and avoid installing dependencies with administrator privileges.

6. Configure pip to use trusted package indexes explicitly and prevent fallback to untrusted or unintended sources.

7. Add automated dependency vulnerability and provenance scanning to the release process.

8. Test pinned updates before publishing a revised skill package.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill tells the agent to execute conversion commands and send resulting files 'directly' and 'do not ask for confirmation,' which removes a safety checkpoint around shell execution and data exfiltration. In context, the agent may process attacker-supplied file paths or sensitive local DXF files and immediately export/send derived content, increasing the risk of unintended file handling or disclosure.

Content

No source excerpt is available for this finding.

Lp4

Low

• Category: MCP Least Privilege
• Confidence: 65% confidence

Finding

Declared permissions with no matching code capability may indicate removed functionality or pre-staging for future abuse.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'ezdxf' is unpinned, so installs may resolve to different versions over time, including versions with breaking changes or newly introduced vulnerabilities. In a skill with shell execution permission that processes external DXF files, uncontrolled dependency drift weakens reproducibility and supply-chain assurance.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text

ezdxf
matplotlib
Pillow

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency 'matplotlib' is unpinned, which allows the environment to install whatever latest compatible release is available at install time. This creates supply-chain and stability risk, especially for a file-conversion skill that may run in automated environments and handle untrusted input.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text

ezdxf
matplotlib
Pillow

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The dependency 'Pillow' is unpinned, and this is more dangerous than a generic unpinned package because Pillow has a history of security advisories affecting image parsing and processing. Since this skill converts files into image formats, Pillow is likely in the attack path for untrusted content, making version uncertainty materially risky.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text

ezdxf
matplotlib
Pillow

Unverifiable Dependency: Pillow has 16 known advisory(ies) (CVE-2016-2533 (Pillow buffer overflow in ImagingPcdDecode); CVE-2023-50447 (Arbitrary Code Execution in Pillow); CVE-2021-27922 (Pillow Uncontrolled Resource Consumption) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Pillow has multiple known advisories, including issues such as arbitrary code execution and resource-consumption flaws, and the manifest does not specify a version. Because this skill converts files to image outputs, Pillow is plausibly exposed to attacker-controlled input or generated content, so an affected installed version could enable denial of service or worse depending on the exact vulnerability.

Content

No source excerpt is available for this finding.