S³ Security Audit

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:56 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent security-audit checklist, but it includes an automatic unpinned runtime package install that can modify and execute code in the user's environment.

Install only if you are comfortable with the agent running local audit commands over your project and potentially printing secrets found in files. Before using the Python dependency step, install `pip-audit` yourself in an isolated, trusted environment or require the agent to skip automatic installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:56

Finding

Unpinned Runtime Installation of a Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 56–57
Vulnerability Type: Unsafe, unpinned dependency installation
Risk Level: Medium

Complete Code Snippet:

bash

# Python
pip-audit 2>/dev/null || pip install pip-audit && pip-audit

Technical Analysis

If the initial pip-audit command fails, the instruction automatically installs pip-audit from the configured Python package index. It does not pin an audited version, verify package hashes, restrict resolution to an approved index, or isolate the installation from the host Python environment.

Because Python package versions and transitive dependencies are mutable external inputs, the code executed during installation and subsequent invocation may differ from what was reviewed in this project. Operator-controlled package-index configuration could also redirect resolution to an untrusted source. The command mutates the audit environment and then executes the newly retrieved tool.

Shell operator precedence also means the final pip-audit executes whenever the installation command succeeds; therefore, newly downloaded package code is immediately invoked.

Attack Path

1. An agent follows the dependency-scanning instructions on a system where the initial pip-audit invocation fails or the command is unavailable.
2. The fallback runs pip install pip-audit.
3. pip resolves an unpinned release and its transitive dependencies through the environment's configured package index.
4. A compromised release, dependency, or untrusted package index supplies malicious package code.
5. Package installation processes the downloaded distribution, and the final pip-audit invocation executes the installed code.
6. The malicious code runs with the privileges and environmental access of the user performing the audit.

Impact Assessment

Successful exploitation could execute arbitrary code under the auditing user's a ...[truncated 410 chars]

Remediation

View remediation

Remediation Suggestions

• Do not automatically install security tools as a fallback during an audit. Declare pip-audit as a prerequisite and fail with a clear installation message when it is unavailable.
• Run the scanner from a dedicated, non-privileged container or isolated virtual environment rather than modifying the audited application's environment.
• Pin a reviewed pip-audit version and all relevant transitive dependencies.
• Require cryptographic hashes, such as through a hash-locked requirements file and pip install --require-hashes.
• Restrict package retrieval to an explicitly approved HTTPS package index and prevent fallback to untrusted indexes.
• Build and verify the scanner environment separately, then invoke it without installing packages at audit time.
• Run the audit using a least-privileged account without access to unrelated credentials or sensitive resources.

A safer workflow is:

bash

command -v pip-audit >/dev/null 2>&1 || {
  echo "ERROR: pip-audit must be installed in an approved isolated environment."
  exit 1
}
pip-audit

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Secrets Detection:

bash

# Grep for common secret patterns
grep -rn "API_KEY\|SECRET\|PASSWORD\|TOKEN\|PRIVATE_KEY\|aws_access\|ssh-rsa" --include="*.py" --include="*.js" --include="*.ts" --include="*.env" --include="*.yaml" --include="*.yml" --include="*.json" . | grep -v node_modules | grep -v .git | grep -v "*.example"

Dependency Vulnerabilities:

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

# Dockerfile issues
grep -n "FROM.*latest\|--no-check-certificate\|curl.*\|.*http:" Dockerfile* 2>/dev/null

# CORS configuration
grep -rn "Access-Control-Allow-Origin.*\*\|cors({.*origin.*true\|CORS(.*allow_all" --include="*.py" --include="*.js" --include="*.ts" .

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest says to use the skill when asked to 'scan code for vulnerabilities,' 'perform a security review,' 'audit a project,' or 'check for security issues.' These are broad natural-language requests that could match many ordinary conversations about security, and the file does not provide exclusion conditions or negative examples to narrow invocation scope.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 65% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

# Dockerfile issues
grep -n "FROM.*latest\|--no-check-certificate\|curl.*\|.*http:" Dockerfile* 2>/dev/null

# CORS configuration
grep -rn "Access-Control-Allow-Origin.*\*\|cors({.*origin.*true\|CORS(.*allow_all" --include="*.py" --include="*.js" --include="*.ts" .

# TLS/SSL

Static analysis

No suspicious patterns detected.