STDF Reader

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:56 AM UTC
• Version: 1.0.0

Overview

This skill coherently documents an STDF file conversion and reporting CLI, with no hidden or unrelated behavior found.

Install the package in a dedicated virtual environment under a non-privileged account, consider pinning and reviewing a known stdf-reader version, and remember that generated CSV/XLSX/PDF outputs default to the input file directory unless an output path is specified.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11–14
Vulnerability Type: Unpinned package dependency from a mutable public registry
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Prerequisites

Install via pip (python version 3.9+):
```bash
pip install stdf-reader

text

### Technical Analysis

The installation instruction retrieves `stdf-reader` from pip's configured package index without specifying a reviewed version, an integrity hash, or a verified immutable source. Consequently, the package installed at any given time may differ from the version originally assessed by the skill author.

Python package installation can execute package-controlled build hooks, while the installed package itself runs with the invoking user's permissions when its CLI is used. If the package account, distribution infrastructure, configured package index, or a future release is compromised, following this instruction could introduce attacker-controlled code. The instruction to use a virtual environment reduces dependency conflicts but does not prevent malicious code from accessing resources available to the user.

### Attack Path

1. An attacker compromises the `stdf-reader` package, its publisher account, its release process, or a package index trusted by pip.
2. The attacker publishes a malicious release under the same package name.
3. A user follows the documented `pip install stdf-reader` command.
4. Pip resolves the unpinned dependency to the malicious or compromised release.
5. Attacker-controlled code executes during package installation or when the `stdf-reader` command is invoked.
6. The payload accesses, alters, or exfiltrates data available to the installing user.

### Impact Assessment

Successful exploitation could provide code execution with the privileges of the user running pip or invoking the installed CLI. The accessible scope may include STDF input files, generated reports, e
...[truncated 366 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin stdf-reader to a specifically reviewed version, for example:

   bash

   python -m pip install "stdf-reader==<reviewed-version>"
   

2. Obtain and verify distribution hashes, then install from a locked requirements file using:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Record the expected package source and reject unexpected package indexes or mirrors.
4. Review the selected wheel or source distribution, including build metadata and installation hooks, before approving it.
5. Prefer a prebuilt, verified wheel where appropriate to avoid unnecessary source-build execution.
6. Retain virtual-environment isolation and run installation and processing under a non-privileged account with access limited to required input and output files.
7. Add dependency monitoring and repeat the security review before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.