T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy_model.py:20- Finding
Unsafe Deserialization of Untrusted Model Artifacts
- Content
View full analysis
- Remediation
View remediation
Security audit
Electricity Forecasting Framework
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent electricity forecasting package, but its deployment guidance and scripts include unsafe production patterns that deserve careful review before use.
Install only if you are comfortable reviewing and hardening the deployment pieces. Do not load untrusted .joblib or PyTorch model files, avoid generated source from untrusted feature configs, run scheduled jobs under a dedicated non-root account, add authentication and request limits before exposing the API, and pin dependencies for production builds.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy_model.py:85- Finding
Python Code Injection in Generated Inference Wrapper
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/deploy_model.py:235- Finding
Unpinned Dependencies Produce Mutable and Non-Reproducible Deployment Builds
- Content
View full analysis
=2.0.0 numpy>=1.24.0 scikit-learn>=1.3.0 lightgbm>=4.0.0 joblib>=1.3.0 fastapi>=0.100.0 uvicorn>=0.23.0 pydantic>=2.0.0 ``` ### Technical Analysis The generated Dockerfile installs the latest package versions available at build time. The generated `requirements.txt` uses lower bounds rather than exact reviewed versions and does not include package hashes. The base image is also referenced by a mutable tag instead of an immutable digest. As a result, two builds from identical source can install materially different code. A compromised future release, dependency account, package index, or transitive dependency can introduce malicious code or a newly disclosed vulnerability without any project source change. ### Attack Path 1. A listed package or one of its transitive dependencies publishes a compromised release, or the package distribution channel is compromised. 2. A user rebuilds the generated deployment image. 3. `pip install` resolves the mutable requirement to the compromised version. 4. Malicious code executes during installation, import, API startup, or model inference. 5. The compromised dependency inherits access to the service environment, model files, network, and mounted volumes. ### Impact Assessment The direct privilege level is that of the image build process or running API container. A compromised dependency can alter forecasts, steal environment credent ...[truncated 182 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/deployment.md:646- Finding
Forecasting Jobs Are Scheduled for Persistent Execution as Root
- Content
View full analysis
> /var/log/forecast.log 2>&1 # Hourly forecast update 0 * * * * root /usr/bin/python3 /opt/electricity_forecast/hourly_update.py >> /var/log/forecast.log 2>&1 # Daily metrics calculation at 6 AM 0 6 * * * root /usr/bin/python3 /opt/electricity_forecast/calculate_metrics.py >> /var/log/forecast.log 2>&1 # Weekly drift check on Monday at 7 AM 0 7 * * 1 root /usr/bin/python3 /opt/electricity_forecast/check_drift.py >> /var/log/forecast.log 2>&1 # Monthly retraining check on 1st at 8 AM 0 8 1 * * root /usr/bin/python3 /opt/electricity_forecast/check_retrain.py >> /var/log/forecast.log 2>&1 ``` ### Technical Analysis The deployment guide instructs operators to execute all forecasting, monitoring, and retraining jobs as `root`. These operations do not inherently require unrestricted host privileges. Python resolves imported modules from multiple paths, and the jobs are expected to read model and configuration artifacts. If an attacker can modify a scheduled script, imported module, model artifact, configuration file, working directory, or dependency, cron converts that limited write capability into recurring root-level code execution. The scheduled nature of the configuration also makes the execution cross-session and persistent once installed. ### Attack Path 1. An operator installs the documented cron configuration. 2. An attacker gains write access to a scheduled Python script, an imported module, a model file subject to unsafe deserialization, or another file used by the scheduled process. 3. The attacker inserts a payload into that writable execution path. 4. Cron invokes the affected task as `root`. 5. The payload e ...[truncated 483 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/deploy_model.py:287- Finding
Generated Forecast API Is Exposed Without Authentication or Resource Limits
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The supplied code is clearly related to electricity/load forecasting evaluation, so it is not unrelated or malicious. However, the declared description presents a broad, comprehensive forecasting framework with statistical, ML, and deep learning support plus deployment and uncertainty features. This code chunk actually implements a narrower capability: backtesting/evaluation for three tree-based ML models only (LightGBM, XGBoost, Random Forest). It does not show ARIMA/SARIMA, neural models, uncertainty quantification, or deployment behavior. Because the description materially overstates the capabilities represented by this chunk, the description does not accurately represent what this specific supplied code actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The description claims a comprehensive electricity load and demand forecasting framework with multiple model families, evaluation, and uncertainty quantification. The supplied code chunk only performs preprocessing: loading/validating time series data, imputing missing values, engineering features, optionally merging weather data, adding holiday features, and saving processed outputs. Weather integration is present and relevant, but the core declared capabilities around forecasting methods, model training/inference, evaluation, and deployment are absent from this code. This is therefore a material description-behavior mismatch, with the actual code representing a preprocessing component rather than the full declared framework.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The code is clearly aligned with the general domain of electricity load forecasting, so the primary purpose matches at a high level. However, the declared description materially overstates the implemented capabilities in this code chunk. The script only trains and evaluates a subset of models and saves artifacts locally. It does not implement several specifically claimed model families (ARIMA, GRU, Transformer, TFT), nor uncertainty quantification. It provides generic feature usage and metric calculation, but not explicit weather integration or deployment/production pipeline features. Therefore this is a description-behavior mismatch due to significant missing claimed capabilities, even though the overall forecasting purpose is consistent.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/train_model.py --model xgboost --data processed/ --horizon 24
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/train_model.py --model xgboost --data processed/ --horizon 24
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md python scripts/train_model.py --model xgboost --data processed/ --horizon 24
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md # API access example import requests url = "https://api.pjm.com/api/v1/inst_load" params = { 'startDate': '20240101', 'endDate': '20240131',
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md **Description**: UK electricity system operator data. **Source**: https://data.nationalgrideso.com/ **Details**: - Great Britain grid
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md **Description**: UK electricity system operator data. **Source**: https://data.nationalgrideso.com/ **Details**: - Great Britain grid
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import requests url = "https://api.openweathermap.org/data/2.5/onecall/timemachine" params = { 'lat': 39.9042, 'lon': 116.4074,
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The holiday feature example defaults to
country='CN'and adds China-specific logic such as Chinese New Year and northern China heating season. In a general-purpose feature engineering guide, this forces a specific locale and regional assumptions rather than offering a user choice or clearly restricting the guide to China-focused forecasting.- Content
Insecure deserialization: joblib.load()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
The script deserializes an attacker-controlled or untrusted model file using joblib.load(), which relies on Python pickle semantics and can execute arbitrary code during loading. In a deployment utility that accepts a model path from the command line, this creates a direct code execution path if a malicious model artifact is supplied from a compromised registry, shared filesystem, or download source.
- Content
python """Load trained model.""" print(f"Loading model from {model_path}") package = joblib.load(model_path) if isinstance(package, dict): model = package.get('model', package)
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest describes an electricity forecasting framework for building and evaluating forecasting systems, but this script also generates a FastAPI server with public endpoints and later packages it into a deployable service. While deployment pipelines are mentioned in the manifest, exposing an HTTP API is a broader operational capability than core forecasting logic and is not reflected in the file's own stated purpose of merely exporting a model for production use.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 75% confidence
- Finding
Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The top-level documentation frames the script narrowly as a model export utility. In practice, the implementation writes multiple deployment artifacts including a web API server, container definition, dependency manifest, and documentation, which is materially broader than simple model export.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The code hard-codes a China-specific holiday locale in
create_holiday_features(..., country='CN')and also sets the CLI default for--countrytoCN. This imposes a specific locale by default rather than prompting for or clearly requiring user selection, which can violate language/locale policy expectations when used in broader contexts.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The module docstring claims support for GRU, Transformer, and Prophet models, but the CLI only accepts lightgbm, xgboost, random_forest, lstm, and sarima. This creates a manifest/code behavior mismatch because the file presents broader forecasting capabilities than it actually implements.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs multiple file-write operations, including creating the output directory and saving model, metrics, and config artifacts. Although it logs the saved paths after writing, there is no prior disclosure or warning that running the script will modify the local filesystem under the selected output directory.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The inline comments distinguish LSTM sequence handling from tree-model flattening, but both branches call the same create_sequences and split functions without any flattening at that stage. The actual flattening for tree models happens later inside individual training functions, so the comment actively misdescribes what this code block does.
- Content