Portfolio Dehydrator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:57 AM UTC
• Version: 1.0.3

Overview

This skill’s behavior matches its stated Web3 portfolio-reporting purpose, with ordinary caveats around public exchange queries and unpinned Python dependencies.

Install in a virtual environment or container, review/pin dependency versions before production use, and remember that queried token symbols are sent to public exchange APIs. Do not pass wallet private keys; the current backend does not need them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: assets/requirements.txt:1

Finding

Unpinned Third-Party Dependencies Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: assets/requirements.txt:1-4
Related Locations: SKILL.md:15-17, README.md:103-106
Vulnerability Type: Unpinned and non-reproducible dependencies
Risk Level: Medium

Vulnerable Code

text

requests
pandas
numpy
scipy

The documented installation command executes dependency resolution without version or integrity constraints:

bash

python3 -m pip install -r assets/requirements.txt

Technical Analysis

All four dependencies are specified without exact versions or cryptographic hashes. Each installation can therefore resolve different package releases from the configured Python package index.

The package names are legitimate and the audit found no evidence of dependency confusion, typosquatting, a malicious package source, or a currently compromised dependency. Nevertheless, this configuration implicitly trusts all future releases selected by pip. If an upstream project, maintainer account, package index, or release artifact is compromised, pip could retrieve an attacker-controlled release.

Python source distributions can execute build-backend code during installation. A malicious wheel or dependency can also execute code when imported by assets/web3_portfolio_optimizer.py. Consequently, dependency compromise could turn the documented installation or normal runtime into a local code-execution channel.

Attack Path

1. An attacker compromises one of the named upstream packages, its maintainer account, release process, or distribution channel.
2. The attacker publishes a malicious version that still satisfies the unconstrained dependency declaration.
3. A user follows the documented installation command.
4. Pip resolves and downloads the malicious release because no reviewed version or hash is enforced.
5. Attacker-controlled code executes through package build hooks, installation behavior, or a later import.
6. The code opera ...[truncated 970 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace unconstrained dependency names with reviewed exact versions using ==.

2. Generate and commit a lock file through a reproducible dependency-management process.

3. Record cryptographic hashes for every direct and transitive artifact and install with:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Build dependencies in an isolated environment and prefer reviewed binary wheels from a trusted package index.

5. Add automated dependency vulnerability and provenance scanning to CI.

6. Establish a controlled update process that reviews release notes, validates hashes, runs tests, and regenerates the lock file before adopting new versions.

7. Run installation and execution as a non-privileged user inside a virtual environment or container with only the filesystem and network access required for public market-data retrieval.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

- Reuse [assets/web3_portfolio_optimizer.py](assets/web3_portfolio_optimizer.py) as the starting template when the user wants a full backend file quickly; adapt

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

- Reuse [assets/web3_portfolio_optimizer.py](assets/web3_portfolio_optimizer.py) as the starting template when the user wants a full backend file quickly; adapt

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

- Use deterministic cap buckets: `BTC` and `ETH` at `0.50`, configured blue-chip whitelist at `0.30`, default long-tail assets at `0.15`, new tokens at `0.05`.
- Make caps and token-category lists explicit and easy to edit near the top of the file.

## Output Rules

- Emit professional Chinese Markdown.
- Default to a client-facing report style: professional but readable for non-quant users.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The description states that the output is a client-facing Chinese Markdown report, which imposes a specific language by default. Under the policy, forcing a language or locale without offering user choice or documenting a justified regional constraint is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill explicitly instructs implementation of a backend that fetches market data from multiple public exchanges, which requires network access, yet it declares no tool scope such as permissions or allowed-tools. This creates a mismatch between declared capabilities and actual behavior, reducing sandbox transparency and increasing the chance that an agent may make outbound requests without clear policy review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction says to 'default to Chinese comments and report text unless the user asks otherwise,' which imposes a specific language preference by default. Under the policy, forcing a language or locale without user opt-in is a natural-language policy violation unless clearly justified.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · assets/web3_portfolio_optimizer.py (reported line 26)May include surrounding context.

python

"https://aws.okx.com",
    "https://www.okx.com",
)
GATE_API_BASE_URL = "https://api.gateio.ws/api/v4"
BYBIT_API_BASE_URL = "https://api.bybit.com"
BITGET_API_BASE_URL = "https://api.bitget.com"
OKX_KLINE_ENDPOINT = "/api/v5/market/candles"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python skill contains pervasive Chinese-language user-facing text and explicitly states it returns a Chinese Markdown report, indicating a fixed locale choice. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

L060 requires the output to be a professional Chinese Markdown report, which imposes a specific language on all users. Under the policy, forcing a locale or language without user opt-in is a natural-language policy violation unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency manifest leaves requests unpinned, so builds may resolve to different versions over time and can silently introduce vulnerable or breaking releases. Because the version is unspecified, consumers cannot determine whether they are protected from known requests advisories, which weakens supply-chain integrity and reproducibility.

Content

Scanner excerpt · assets/requirements.txt (reported line 1)May include surrounding context.

text

requests
pandas
numpy
scipy

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

Requests has multiple published advisories, and because no version is pinned, it is impossible to verify whether the installed package is affected. In this skill, requests will likely handle outbound HTTP calls to crypto exchange APIs, so pulling a vulnerable version could expose credentials, network trust decisions, or request handling to known flaws.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The unpinned pandas dependency makes installations non-reproducible and allows future resolutions to pull in unexpected versions, including ones with security or compatibility problems. In a data-processing skill, this can change behavior silently and complicate assurance that deployed environments are patched.

Content

Scanner excerpt · assets/requirements.txt (reported line 2)May include surrounding context.

text

requests
pandas
numpy
scipy

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Pandas has at least one published advisory, and the absence of a pinned version means the deployment may unknowingly consume an affected release. Although pandas is typically used for local data handling rather than direct network exposure, unverifiable dependency state still increases supply-chain and reliability risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

Leaving numpy unpinned creates supply-chain uncertainty because the installed version depends on resolution time and environment state rather than an audited baseline. This undermines reproducibility and can expose deployments to known or newly introduced vulnerabilities without any manifest change.

Content

Scanner excerpt · assets/requirements.txt (reported line 3)May include surrounding context.

text

requests
pandas
numpy
scipy

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

NumPy has several historical advisories, and an unpinned manifest prevents verification that installations avoid affected versions. In a computational finance skill, this primarily raises supply-chain and environment consistency concerns, but vulnerable native or parsing code could still increase attack surface if exposed through crafted inputs or package-level flaws.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

An unpinned scipy requirement permits uncontrolled upgrades or downgrades during installation, which can introduce vulnerable releases or unstable behavior. For a portfolio optimization skill that depends on numerical correctness, this also increases operational risk by making results differ across environments.

Content

Scanner excerpt · assets/requirements.txt (reported line 4)May include surrounding context.

text

requests
pandas
numpy
scipy

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

SciPy has published advisories, and without a version pin there is no way to confirm that deployed environments are using a safe release. Since this skill depends on scipy for optimization routines, the main security issue is unverifiable supply-chain state, with secondary risk from installing outdated vulnerable builds.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

L106 says to use detailed Chinese comments, which is another explicit language constraint. This is a policy concern because it requires a specific language rather than offering a choice or documenting a justified regional limitation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.