Security audit

lance-format

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Lance format reference; scanner alerts are about examples, mirrored docs, or formatting rather than hidden execution.

Installers should treat this as a reference skill, not an automation tool. Be careful when copying examples that delete files, overwrite datasets, use non-HTTPS or invalid certificate settings, place credentials in storage_options, or run cleanup with delete_unverified; use test paths and proper secret handling.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (57)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
| `changelog-v7-v13.md` | The full v7 -> v13 delta | 14 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.
md
| `changelog-v7-v13.md` | The full v7 -> v13 delta | 14 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.
md
| `changelog-v7-v13.md` | The full v7 -> v13 delta | 14 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.
md
| `changelog-v7-v13.md` | The full v7 -> v13 delta | 14 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.
md
| `changelog-v7-v13.md` | The full v7 -> v13 delta | 14 |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.
md
| `changelog-v7-v13.md` | The full v7 -> v13 delta | 14 |

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/changelog-v7-v13.md (reported line 924)May include surrounding context.
md
- **#8513 - re-compact.** "Execution applied that target again as a hard `max_rows_per_file`, so each task above the target produced a full fragment followed by a small remainder that could become isolated." - **#8839 - chmod existing files.** Data and index files were created rejecting `group` and `other` permissions, "which caused us trouble when using NFS"; the default is now 0o666. Files already written keep their old mode. - **#8904 - restart long-lived sessions.** The index metadata cache was keyed by dataset

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/docs/format/table/data_overlay_file.md (reported line 7)May include surrounding context.
md
This feature is currently experimental and not yet supported in any library.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/docs/guide/object_store.md (reported line 276)May include surrounding context.
md
| `azure_object_id` / `object_id` | Object id for use with managed identity authentication. | | `azure_msi_resource_id` / `msi_resource_id` | Msi resource id for use with managed identity authentication. | | `azure_federated_token_file` / `federated_token_file` | File containing token for Azure AD workload identity federation. | | `azure_use_azure_cli` / `use_azure_cli` | Use azure cli for acquiring access token. | | `azure_disable_tagging` / `disable_tagging` | Disables tagging objects. This can be desirable if not supported by the backing store. | ## AliCloud Object Storage Service Configuration

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/docs/guide/object_store.md (reported line 407)May include surrounding context.
md
| `azure_object_id` / `object_id` | Object id for use with managed identity authentication. | | `azure_msi_resource_id` / `msi_resource_id` | Msi resource id for use with managed identity authentication. | | `azure_federated_token_file` / `federated_token_file` | File containing token for Azure AD workload identity federation. | | `azure_use_azure_cli` / `use_azure_cli` | Use azure cli for acquiring access token. | | `azure_disable_tagging` / `disable_tagging` | Disables tagging objects. This can be desirable if not supported by the backing store. | ## AliCloud Object Storage Service Configuration

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/docs/quickstart/index.md (reported line 71)May include surrounding context.
Now you'll write this dataframe to Lance format and verify the data was saved correctly:

python
shutil.rmtree("/tmp/test.lance", ignore_errors=True) dataset = lance.write_dataset(df, "/tmp/test.lance") dataset.to_table().to_pandas()

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/docs/quickstart/index.md (reported line 84)May include surrounding context.
Now you'll write this dataframe to Lance format and verify the data was saved correctly:

python
shutil.rmtree("/tmp/test.lance", ignore_errors=True) dataset = lance.write_dataset(df, "/tmp/test.lance") dataset.to_table().to_pandas()

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/docs/quickstart/index.md (reported line 85)May include surrounding context.
Now you'll write this dataframe to Lance format and verify the data was saved correctly:

python
shutil.rmtree("/tmp/test.lance", ignore_errors=True) dataset = lance.write_dataset(df, "/tmp/test.lance") dataset.to_table().to_pandas()

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/indexes.md (reported line 421)May include surrounding context.
md
source schema is a strict subset of the target's and unmatched rows are kept, the builder routes to `RewriteColumns` (a cheap column update) rather than rewriting whole fragments (`rust/lance/src/dataset/write/merge_insert.rs:2232-2260`). Passing a full-schema source for what is logically a two-column update therefore costs dramatically more, with no warning. Project the source down to the key plus the columns actually being updated. - **Local-filesystem durability is delegated, not added.** Lance's `file://` store is `object_store::LocalFileSystem` (`rust/lance-io/src/object_store/providers/local.rs:26`,

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · references/performance.md (reported line 383)May include surrounding context.
md
source schema is a strict subset of the target's and unmatched rows are kept, the builder routes to `RewriteColumns` (a cheap column update) rather than rewriting whole fragments (`rust/lance/src/dataset/write/merge_insert.rs:2232-2260`). Passing a full-schema source for what is logically a two-column update therefore costs dramatically more, with no warning. Project the source down to the key plus the columns actually being updated. - **Local-filesystem durability is delegated, not added.** Lance's `file://` store is `object_store::LocalFileSystem` (`rust/lance-io/src/object_store/providers/local.rs:26`,

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/docs/format/file/encoding.md (reported line 715)May include surrounding context.
md
The compression level is scheme dependent. Currently the following schemes support the following levels: | Scheme | Crate Used | Levels | Default | | ------ | --------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `zstd` | [`zstd`](https://crates.io/crates/zstd) | `0-22` | `crate dependent` (3 as of this writing) | | `lz4` | [`lz4`](https://crates.io/crates/lz4) | N/A | The LZ4 crate has two modes (fast and high compression) and currently this is not exposed to configuration. The LZ4 crate wraps a C library and the default is dependent on the C library. The default as of this writing is fast |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/docs/format/file/encoding.md (reported line 717)May include surrounding context.
md
| Scheme | Crate Used | Levels | Default | | ------ | --------------------------------------- | ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `zstd` | [`zstd`](https://crates.io/crates/zstd) | `0-22` | `crate dependent` (3 as of this writing) | | `lz4` | [`lz4`](https://crates.io/crates/lz4) | N/A | The LZ4 crate has two modes (fast and high compression) and currently this is not exposed to configuration. The LZ4 crate wraps a C library and the default is dependent on the C library. The default as of this writing is fast | Higher compression levels generally provide better compression at the cost of slower encoding speed. Decoding speed

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/docs/format/index/scalar/fts.md (reported line 239)May include surrounding context.
md
### Configuration | Environment Variable | Default | Description | |----------------------------|----------------------------------|-----------------------------------------------------------------------------------------------------------------------| | `LANCE_FTS_NUM_SHARDS` | Number of compute-intensive CPUs | Number of parallel tokenizer worker tasks. Higher values increase indexing throughput but use more memory. | | `LANCE_FTS_PARTITION_SIZE` | 256 (MiB) | Maximum uncompressed size of a worker's in-memory buffer before it is spilled to a part file. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/docs/format/index/scalar/rtree.md (reported line 71)May include surrounding context.
md
### Page File Schema | Column | Type | Nullable | Description | |:-------|:---------|:---------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `bbox` | RectType | false | Type is Rect defined by [geoarrow-rs](https://github.com/geoarrow/geoarrow-rs) RectType; physical storage is Struct<xmin: Float64, ymin: Float64, xmax: Float64, ymax: Float64>. Represents the node bounding box (leaf: item bbox; branch: child aggregation). | | `id` | UInt64 | false | Reuse the `id` column to store `rowid` in leaf pages and `pageid` in branch pages |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/docs/format/index/scalar/rtree.md (reported line 74)May include surrounding context.
md
| Column | Type | Nullable | Description | |:-------|:---------|:---------|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `bbox` | RectType | false | Type is Rect defined by [geoarrow-rs](https://github.com/geoarrow/geoarrow-rs) RectType; physical storage is Struct<xmin: Float64, ymin: Float64, xmax: Float64, ymax: Float64>. Represents the node bounding box (leaf: item bbox; branch: child aggregation). | | `id` | UInt64 | false | Reuse the `id` column to store `rowid` in leaf pages and `pageid` in branch pages | ### Nulls File Schema

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document makes conflicting guarantees about field ID behavior: it first says field IDs are immutable, unique, and stable, then later states dropped column IDs may be reused. In a format specification, this ambiguity is dangerous because independent implementations may make incompatible assumptions, leading to schema confusion, incorrect column resolution, corrupted reads, or authorization/integrity bugs in systems that rely on stable IDs for evolution and lineage.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/docs/format/table/versioning.md (reported line 24)May include surrounding context.
md
<div class="feature-flags-table" markdown="1"> | Flag Bit | Flag Name | Reader Required | Writer Required | Description | |----------|---------------------------------|-----------------|-----------------|-------------------------------------------------------------------------------------------------------------| | 1 | `FLAG_DELETION_FILES` | Yes | Yes | Fragments may contain deletion files, which record the tombstones of soft-deleted rows. | | 2 | `FLAG_STABLE_ROW_IDS` | Yes | Yes | Row IDs are stable for both moves and updates. Fragments contain an index mapping row IDs to row addresses. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/docs/guide/object_store.md (reported line 30)May include surrounding context.
md
These options apply to all object stores. | Key | Description | |------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `allow_http` | Allow non-TLS, i.e. non-HTTPS connections. Default, `False`. | | `download_retry_count` | Number of times to retry a download. Default, `3`. This limit is applied when the HTTP request succeeds but the response is not fully downloaded, typically due to a violation of `timeout`. |

Context Window Stuffing

Medium

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
Content: Scanner excerpt · references/docs/guide/object_store.md (reported line 37)May include surrounding context.
md
These options apply to all object stores. | Key | Description | |------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `allow_http` | Allow non-TLS, i.e. non-HTTPS connections. Default, `False`. | | `download_retry_count` | Number of times to retry a download. Default, `3`. This limit is applied when the HTTP request succeeds but the response is not fully downloaded, typically due to a violation of `timeout`. |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/docs/guide/object_store.md (reported line 30)May include surrounding context.
md
These options apply to all object stores. | Key | Description | |------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | `allow_http` | Allow non-TLS, i.e. non-HTTPS connections. Default, `False`. | | `download_retry_count` | Number of times to retry a download. Default, `3`. This limit is applied when the HTTP request succeeds but the response is not fully downloaded, typically due to a violation of `timeout`. |

Static analysis

No suspicious patterns detected.