Oasyce Vault

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 1.0.0

Overview

DataVault is a coherent local file-inventory skill, but users should choose scan paths carefully and understand that it installs and runs an external Python package.

Install only if you trust the datavault package source. Run scans against a specific directory, use --no-recursive for narrow checks, avoid running as root, and review generated reports before using the optional Oasyce registration flow because that may share or register information externally.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14
• Finding: Unpinned Third-Party Packages Are Installed and Executed## Vulnerability Details **File Location**: `SKILL.md`, lines 14–16 and 66–70 **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Vulnerable code at lines 14–16:** ```bash pip install datavault ``` **Vulnerable code at lines 66–70:** ```bash pip install datavault[oasyce] datavault scan ~/Documents # See what you have oasyce register ~/Documents/report.pdf # Register what matters ``` ### Technical Analysis The skill instructs users to install `datavault` and its optional `oasyce` dependencies from PyPI without pinning exact versions or verifying artifact hashes. Package names alone resolve to mutable external releases and their transitive dependencies. The repository contains only `SKILL.md`; it provides no package source, dependency lockfile, hashes, signatures, or provenance information with which the downloaded implementation can be audited. Consequently, the code ultimately executed by the documented commands can change independently of this reviewed skill. Because the installed command is intended to recursively inspect user-selected directories, a compromised, replaced, dependency-confused, or unexpectedly modified package release could access files within the invoking user's permissions. The optional `oasyce` extra further expands the unreviewed dependency surface. ### Attack Path 1. An attacker compromises a referenced package release, one of its transitive dependencies, or the relevant package publishing account. 2. The attacker publishes a malicious release that remains compatible with the unpinned installation command. 3. A user follows the skill instructions and runs `pip install datavault` or `pip install datavault[oasyce]`. 4. The package installer retrieves the attacker-controlled artifact and may execute package installation hooks or install malicious CLI code. 5. The user invokes `datavault scan`, `datavault classify`, `datavault report`, or the optional `oasyce ...[truncated 761 chars]
• Remediation: ## Remediation Suggestions 1. Pin `datavault`, `oasyce`, and all transitive dependencies to reviewed, exact versions. 2. Maintain a lockfile generated from a trusted dependency resolution process. 3. Require cryptographic hashes for every downloaded artifact, such as through a fully hashed requirements file and `pip install --require-hashes`. 4. Verify package ownership, release provenance, signatures, and source repository before recommending installation. 5. Prefer installation from an organization-controlled package index or verified immutable artifacts. 6. Provide or reference the auditable source corresponding exactly to the pinned releases. 7. Run scanning commands in an isolated environment with least-privilege filesystem access and no unnecessary credentials or network connectivity. 8. Avoid running package installation or scanning commands as an administrator or root user. 9. Document the directories and data the tool is expected to access, and require explicit user approval before scanning sensitive locations or registering files externally.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrasing is broad enough to match common file-management or general scanning requests, which can cause the agent to invoke this skill in contexts where the user did not clearly intend a recursive data inventory operation. In a local-first scanning skill, overbroad activation increases the chance of inspecting unrelated or sensitive files and expanding the scope of access beyond user expectations.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill documents recursive directory scanning as the default but does not warn that this may traverse sensitive locations and enumerate private content the user did not mean to inspect. Because the tool is designed to classify many file types and generate reports, missing a privacy/scope warning makes accidental over-collection more likely in normal use.

Static analysis

No suspicious patterns detected.