Stillos Notary

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 1.1.1

Overview

The skill clearly describes a user-directed external notary service and local offline verifier, with no hidden persistence or destructive behavior found.

Install only if you are comfortable sending the claims you ask it to verify, resolver metadata, and an agent identifier to the StillOS/Nola Wealth Financial notary endpoint. For stronger installation hygiene, use a virtual environment and pin or review the `stillos` package version before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–38
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

markdown

## Quick start (Python)

```bash
pip install stillos

text

### Technical Analysis

The quick-start instructions direct users to install the latest available release of the third-party `stillos` package from pip's configured package index. The command does not pin an audited version, verify package hashes, use a lock file, or identify an authoritative source repository and verification process.

Consequently, the code installed by users can differ from the code reviewed during this audit. This creates a supply-chain risk if the package publisher account or distribution channel is compromised, a malicious release is published, package ownership changes, or an unexpected update introduces unsafe behavior. Python packages may execute code during installation or when imported and used by the documented workflow.

This finding does not establish that the current `stillos` package is malicious. It identifies that the documented installation process does not provide reproducible or integrity-verified dependency resolution.

### Attack Path

1. An attacker compromises the `stillos` publisher account, its build or release process, or another component of its package distribution channel.
2. The attacker publishes a malicious release under the expected package name.
3. A user follows the documented `pip install stillos` command after that release becomes current.
4. Pip downloads and installs the attacker-controlled package because no trusted version or artifact hash is specified.
5. Malicious installation or runtime code executes when the package is installed, imported, or used.

### Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the user or environment running pip or the Python application. Depending on those privileges an
...[truncated 459 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version rather than installing the latest release implicitly.
• Publish a reproducible requirements or lock file containing exact transitive dependency versions.
• Provide cryptographic hashes for approved distributions and require installation with pip's --require-hashes option.
• Document the authoritative source repository, expected publisher identity, and package verification procedure.
• Build dependencies in a controlled pipeline and retain provenance or software bill of materials information for released artifacts.
• Recommend installation in an isolated virtual environment under a non-privileged account.
• Establish an explicit update process in which new package versions are reviewed and their hashes updated before users are instructed to install them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

Quick start (raw HTTP, any language)

bash

curl -s -X POST https://nolawealthfinancial.com/notary/claim-verdict \
  -H "Content-Type: application/json" \
  -H "X-Agent-Id: your-agent-id" \
  -d '{

Static analysis

No suspicious patterns detected.