T08 · Insecure Dependencies
Warning
- Location
scripts/download_international_qs.py:62- Finding
Unverified and Unbounded Downloads from Third-Party and Typo-Like Sources
- Content
View full analysis
- Remediation
View remediation
Security audit
Design Norm Quantity
Security checks for vulnerabilities and agentic risk
Overview
This skill is a construction cost-estimation toolkit with some overstated accuracy claims and an unsafe optional document downloader, but no evidence of hidden control, credential theft, persistence, or destructive behavior.
Install only if you are comfortable treating this as an advisory construction-estimation aid, not a guaranteed +/-3% professional costing system. Avoid running the international PDF downloader unless you verify the source URLs and scan downloaded documents first.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (163)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The analysis consistently indicates weaker accuracy bands, absent advanced AI implementations, and version inconsistency relative to the manifest's strong claims. In a skill ecosystem, this is a high-risk transparency failure because it can alter review outcomes, user consent, and authorization decisions.
- Content
Static analysis
No suspicious patterns detected.