Security audit

Cold Chain Risk Calculator

Security checks for vulnerabilities and agentic risk

Overview

This is a simple local cold-chain risk calculator with a real input-validation weakness, but no evidence of hidden access, persistence, exfiltration, or unsafe privilege use.

Before installing, treat this as a draft calculator rather than an authoritative logistics or compliance decision tool. Use only realistic positive durations, and be aware that the documentation mentions file input/output more broadly than the current script implements.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Note

Location: scripts/main.py:10
Finding: Negative Transport Duration Produces a Misleading Low-Risk Assessment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: For markdown files, missing-warning findings apply when the description omits user-facing warnings about behaviors that can affect user data or system integrity. Here, the document notes file system access and output files in the risk table, but it does not present this as an explicit user warning in the usage or overview sections.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.