Oasyce

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:58 AM UTC
• Version: 3.3.0

Overview

The skill is coherent for an AI data marketplace, but it normalizes real-value marketplace actions and unverified package installs without enough guardrails.

Install only in an isolated environment, verify the package source and version before use, and require explicit human approval for buy, sell, dispute, resolve, onboarding, or any command that spends funds, changes marketplace state, or sends data to a remote endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned Third-Party Python Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

bash

pip install oasyce
oas doctor --json    # verify installation

Technical Analysis

The skill directs users or agents to install the latest available oasyce package from the configured Python package index. It does not pin a reviewed version, verify package hashes, use a lockfile, identify a trusted publisher or repository, or require an isolated environment.

Python package installation may execute package-controlled build or installation logic. Consequently, a compromised publisher account, malicious replacement package, dependency-confusion event, or unexpectedly compromised future release could execute attacker-controlled code. The project only contains SKILL.md, so there is no local implementation against which the installed oas CLI can be audited.

No evidence establishes that the named package is currently malicious; the confirmed issue is the unsafe, non-reproducible dependency installation practice.

Attack Path

1. An attacker compromises the package, its publisher account, or one of its transitive dependencies.
2. The attacker publishes a malicious release under a version accepted by the unpinned installation command.
3. A user or agent follows the skill and runs pip install oasyce.
4. Pip downloads the attacker-controlled release from the configured package index.
5. Malicious build, installation, import, or CLI code executes with the privileges of the installing or invoking user.
6. The malicious package can abuse subsequent marketplace operations performed through the installed CLI.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. The attacker could access files, environment variables, network credentials, marketplace-related data, and othe ...[truncated 393 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version using an exact version constraint.
• Publish a lockfile containing all resolved transitive dependencies.
• Require cryptographic hashes and install with pip --require-hashes.
• Document the canonical source repository, package-index namespace, and verified publisher.
• Review package contents and transitive dependencies before approving version updates.
• Install the package in a dedicated virtual environment or sandbox under a least-privileged account.
• Prefer reproducible, signed release artifacts and verify signatures or attestations where available.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:88

Finding

Unpinned Python SDK Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 88
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

markdown

For programmatic access, use `pip install oasyce-sdk`:

Technical Analysis

The skill recommends installing oasyce-sdk without an exact version, integrity hash, lockfile, trusted-source declaration, or publisher verification. This makes SDK installation non-reproducible and allows future package-index state to determine which code is installed.

A compromised or malicious package release can run code during installation or when the SDK is imported. The subsequent example imports OasyceClient and uses it to communicate with a service, creating an execution path for package-controlled Python code. The repository contains no local SDK implementation that could be inspected to validate package behavior.

No evidence establishes that oasyce-sdk is currently malicious; the vulnerability is the unsafe dependency acquisition and verification process.

Attack Path

1. An attacker gains control of the package publication channel or compromises a transitive dependency.
2. The attacker publishes a malicious version accepted by pip install oasyce-sdk.
3. A developer or agent follows the documentation and installs the unpinned SDK.
4. Pip retrieves and installs the malicious release.
5. Attacker-controlled code executes during installation or when oasyce_sdk is imported.
6. The code accesses resources available to the Python process or manipulates data and requests handled through the SDK.

Impact Assessment

Exploitation could result in arbitrary code execution with the developer's or runtime service account's permissions. Exposed resources may include application files, environment variables, API credentials, local service data, and network-accessible systems. A malicious SDK could also modify marketplace requests, falsify returned ...[truncated 238 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the floating installation instruction with an exact, reviewed SDK version.
• Supply a dependency lockfile with hashes for the SDK and all transitive packages.
• Use pip --require-hashes and a trusted, explicitly configured package index.
• Identify and link the canonical source repository and verified package publisher.
• Add automated dependency scanning, release-signature verification, and controlled update review.
• Run SDK-based applications in isolated environments with least-privilege filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents buying, selling, quoting, and disputing marketplace assets without any warning that these are financially impactful operations involving real value, fees, and potential irreversible loss. In an agent setting, presenting transactional commands as routine can lead to unintended trades or dispute actions being executed without adequate user confirmation or policy checks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The capability registration and invocation sections normalize sending endpoints and JSON inputs over the network without warning that prompts, data, and metadata may be transmitted to third-party services. This is dangerous because agents may pass sensitive user or system data to external providers, creating confidentiality, compliance, and supply-chain risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The example explicitly registers an HTTPS endpoint for an external API, which indicates that use of the skill can cause data to be sent to remote services outside the local trust boundary. Although the example itself is not malicious, in this skill context it increases risk because users may invoke remote capabilities with sensitive payloads and assume the marketplace abstraction is safe by default.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Register a capability:

bash

oas capability register --name "Translation API" \
  --endpoint https://api.example.com/translate \
  --price 0.5 --tags nlp,translation --json

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Node onboarding, peer inspection, and identity diagnostics are exposed as simple commands without explaining that they can reveal node identity, peer relationships, and network participation. While these are expected platform functions, omitting warnings can cause operators to expose infrastructure details or enroll nodes without understanding the visibility and operational consequences.

Content

No source excerpt is available for this finding.