Multimodal Pet Health Engine

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:16 PM UTC
• Version: 1.1.0

Overview

The skill mostly runs a local radar-simulation demo, but it also emits an automatic climate-control override intent from hardcoded simulated data without clear user confirmation or containment.

Review this carefully before installing in any environment where stdout is consumed by an automation bus. It is reasonable as a local simulation/report generator, but do not connect its PET_CARE_OVERRIDE output to HVAC or other spatial controls unless you add explicit user approval, real sensor validation, and clear routing safeguards. Install dependencies in an isolated environment and prefer pinned, hash-verified package versions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: requirements.txt:4

Finding

Unbounded and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: requirements.txt:4-6 and SKILL.md:17
Vulnerability Type: Supply-chain exposure through unpinned dependencies without integrity verification
Risk Level: Medium

Vulnerable Code:

text

numpy>=1.24.0      # Matrix operations and Fast Fourier Transform support
scipy>=1.10.0      # Signal processing and Butterworth bandpass filtering
matplotlib>=3.7.0  # Diagnostic chart rendering

The documented installation command is:

bash

pip install -r requirements.txt

Technical Analysis

All three dependencies use open-ended minimum-version constraints. Consequently, installation may resolve to any later version available from the configured package index rather than to versions that were specifically reviewed and tested with this project. No lock file or cryptographic package hashes are supplied.

Python package installation can execute package build and installation logic under the identity of the user running pip. If an allowed future release or its distribution infrastructure is compromised, the documented installation process could retrieve and execute code that was not present during this audit. The absence of hashes also prevents pip from verifying that downloaded artifacts match project-approved files.

This finding does not establish that the currently named packages are malicious. The risk arises from non-reproducible resolution and the lack of artifact integrity controls.

Attack Path

1. An attacker compromises a future release, maintainer account, distribution artifact, or package index serving one of the permitted dependencies.
2. The malicious release retains a version number satisfying the applicable minimum-version constraint.
3. A user follows the documented command pip install -r requirements.txt.
4. Pip selects and downloads the compromised release because no exact version or approved hash restricts resolution.
5. Mal ...[truncated 908 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace open-ended constraints with exact versions that have been reviewed and tested, for example:

   text

   numpy==<reviewed-version>
   scipy==<reviewed-version>
   matplotlib==<reviewed-version>
   

2. Generate a reproducible lock file containing all transitive dependencies.

3. Record SHA-256 hashes for every approved distribution artifact and install with:

   bash

   pip install --require-hashes -r requirements.txt
   

4. Configure pip to use a trusted, controlled package index or internal mirror.

5. Install dependencies in an isolated virtual environment or container under a non-privileged account.

6. Add automated dependency vulnerability and provenance scanning to CI.

7. Review, test, and explicitly approve dependency updates before changing locked versions or hashes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This is a markdown file, so SQP-2 applies to user-facing descriptions of behaviors that affect user data or system state. Lines L50-L52 state that running the script saves a report image file, but the description does not explicitly warn the user that local files will be written.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes the skill as generating health reports and 'automatically adjust[ing] spatial elements (e.g., HVAC)' but does not define the conditions, scope, or boundaries for when those actions occur. In a manifest file, this kind of broad activation/behavior description can create ambiguity about when the skill should be invoked or allowed to act.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This requirements file contains natural-language comments entirely in Chinese, which can impose a language constraint on maintainers or users who do not read that language. The file does not indicate that the skill is region-specific or provide any opt-in or bilingual alternative, so it may violate the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: scipy has 4 known advisory(ies) (CVE-2013-4251 (SciPy creates insecure temporary directories); CVE-2013-4251 (The scipy.weave component in SciPy before 0.12.1 creates insecure temporary dire); CVE-2023-25399 (A refcounting issue which leads to potential memory leak was discovered in scipy) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The docstring says the component performs fused warning and routing, and the log messages state that Agent:Climate has taken over and is adjusting airflow. In reality, the function only reads a temperature field, evaluates a condition, and prints text describing an intended action; no real routing, dispatch, or control call occurs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.