Traffic Crash Specialist

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:27 AM UTC
• Version: 1.0.0

Overview

The skill is a traffic-crash video analysis guide, but its setup path asks users to run mutable third-party code without pinning or integrity checks.

Install only in an isolated environment without sensitive credentials, pin the CrashChat repository and Hugging Face artifacts to reviewed revisions, verify dependency and wheel checksums, and review the shell/Python scripts before running training or evaluation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:86

Finding

Execution of Unpinned Third-Party Repository Code and Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 86–128
Vulnerability Type: Unpinned and unaudited third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# Clone repository
git clone https://github.com/Liangkd/CrashChat.git
cd CrashChat

# Create environment
conda create -n crashchat python=3.10 -y
conda activate crashchat

# Install dependencies
pip install torch==2.4.0 torchvision==0.19.0 --extra-index-url https://download.pytorch.org/whl/cu118
pip install -r requirements.txt
pip install flash_attn-2.7.3+cu11torch2.4cxx11abiFALSE-cp310-cp310-linux_x86_64.whl --no-deps
conda install -c conda-forge ffmpeg -y

bash

# Baseline model
huggingface-cli download KDliang/crashchat --local-dir ./ckpt

bash

# Single GPU
CUDA_VISIBLE_DEVICES=0 bash scripts/train/Independent_monotask_models_causal_reasoning.sh 1

# Multiple GPUs
CUDA_VISIBLE_DEVICES=1,2 bash scripts/train/Independent_monotask_models_causal_reasoning.sh 2

bash

# 1. Convert weights
python tool/merge_and_convert_videollama3_lora.py

# 2. Run evaluation
CUDA_VISIBLE_DEVICES=0 bash scripts/eval/eval_video_causal_reasoning.sh

# 3. Calculate metrics
python scripts/eval/compute_causal_reasoning_metrics.py

Technical Analysis

The installation instructions clone the current state of an external Git repository without selecting an immutable, reviewed commit. They subsequently install the repository's requirements.txt and direct users to execute shell and Python scripts obtained from that repository. The effective code executed by users can therefore change after this Skill has been reviewed.

The Hugging Face download is likewise not pinned to an immutable revision or accompanied by artifact checksums. The locally referenced FlashAttention wheel has no documented trusted source or integrity hash. Although no malicious upstream content was observed in the audited project ...[truncated 1940 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CrashChat repository to a reviewed full commit SHA and check out that commit explicitly after cloning.
2. Pin the Hugging Face download with an immutable revision and record expected SHA-256 hashes for every downloaded artifact.
3. Replace the mutable requirements.txt installation with a reviewed lock file containing exact versions and cryptographic hashes.
4. Use pip install --require-hashes where practical and permit packages only from explicitly approved indexes.
5. Document the trusted source and SHA-256 checksum for the FlashAttention wheel; reject installation when verification fails.
6. Review shell scripts, Python tools, package build metadata, and model-loading behavior before execution.
7. Run installation and model workflows in an isolated container or disposable environment with no unnecessary credentials, restricted network access, read-only dataset mounts where possible, and least-privilege filesystem permissions.
8. Avoid loading untrusted serialized model formats that permit executable object deserialization; prefer safer formats such as safetensors when supported.
9. Add automated dependency and artifact verification to the setup procedure so upstream changes fail closed rather than being accepted silently.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description and the main content are written entirely in Chinese, which imposes a language choice on users without any opt-in or alternative language guidance. The file does not state that the skill is region-specific or otherwise justify a Chinese-only interface, so this appears to violate the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file is primarily written in Chinese, but several section titles, task names, and JSON example values are in English. Under the policy rule for language/locale, this can be viewed as implicitly forcing a mixed language experience without explicit user opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file contains natural-language content and appears to present the skill documentation in Chinese by default, while the policy requires flagging language or locale constraints that are imposed without user opt-in. There is no indication that users may choose another language or that the Chinese-only presentation is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This markdown file contains bilingual headings and task descriptions, but it does not clarify whether outputs or interactions must be in Chinese, English, or either. That can create a locale/language policy issue if the skill implicitly assumes a language without explicit user opt-in or documented justification.

Content

No source excerpt is available for this finding.