Can Bus Toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

The skill describes useful provenance tooling, but its broad execution authority, missing implementation, automatic alert/rollback behavior, and external timestamp/webhook flows are not scoped clearly enough for routine installation.

Review this skill before installing in any sensitive environment. Treat OTS submission and webhook/email alerts as external disclosure paths, run any commands only in an isolated environment, avoid auto-rollback until tested, and require pinned dependencies plus real, reviewable scripts and clearer input/output documentation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:242

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 242
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

Vulnerable Code Snippet

bash

pip install opentimestamps-client

Technical Analysis

The setup documentation instructs users to install opentimestamps-client without specifying an exact version, validating package hashes, or using a reviewed lockfile. Dependency resolution therefore selects the latest package and transitive dependencies available from the configured Python package index at installation time.

The effective installed content can change after the Skill has been reviewed. If the upstream package, a transitive dependency, the package index, or the user's package-index configuration is compromised, following the documented command may introduce attacker-controlled code. Source distributions may invoke build backends during installation, while installed package code may execute when subsequently imported or invoked.

This finding is limited to an unsafe dependency-installation practice. The audited project does not itself contain a malicious package payload or executable scripts.

Attack Path

1. An attacker compromises the referenced package, one of its transitive dependencies, or a package source trusted by the user's pip configuration.
2. The attacker publishes a malicious release that satisfies the unconstrained dependency request.
3. A user follows the instruction in SKILL.md and runs pip install opentimestamps-client.
4. Pip resolves the mutable package release and its dependencies without checking project-provided hashes.
5. Attacker-controlled code may execute through the package build process or when the installed component is subsequently imported or invoked.
6. The code runs under the account and environment used for installation or execution.

Impact Assessment

Successful exploitation could provide code executio ...[truncated 567 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to a reviewed exact version, for example:

   text

   opentimestamps-client==<reviewed-version>
   

2. Generate and publish a lockfile containing all transitive dependencies.
3. Record approved distribution hashes and require verification:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Review the selected package release, transitive dependency graph, and package provenance before distribution.
5. Install dependencies in an isolated virtual environment under a non-privileged account rather than into the system Python environment.
6. Use a controlled package repository or allowlisted internal mirror where appropriate.
7. Add automated dependency vulnerability, provenance, and integrity checks to the release process.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The invocation description is overly broad and ambiguous, describing generic analysis, reporting, visualization, and toolkit behavior without a crisp task boundary. In a skill that exposes read, write, and exec, vague scope increases the risk that an agent will apply the skill to unintended data or tasks, expanding the attack surface and making misuse easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill describes submitting timestamps to OpenTimestamps, a third-party external service, but does not clearly warn users that metadata or derived data will leave the local environment. Even if only hashes/timestamps are transmitted, this can leak sensitive workflow timing, dataset existence, or correlation information, which is material in regulated or confidential environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The tamper-alert feature states that alerts may be sent by email or webhook, but it does not clearly warn that incident details may be exfiltrated to external destinations. Alert payloads can contain filenames, hashes, timestamps, and event context, which may expose sensitive operational or forensic information to third parties if not tightly controlled.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The declared inputs (content, strict_level) are generic review parameters and do not match the claimed CAN/provenance functionality such as log paths, hash values, timestamps, database locations, or report options. This disconnect is dangerous because agents may pass arbitrary content into a skill that also advertises exec, read, and write, leading to confused-deputy behavior, unexpected processing, and unsafe execution paths.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented response schema describes a generic grading/audit output rather than outputs for CAN-bus provenance, indexing, OTS submission, or tamper-detection operations. This semantic mismatch can cause an agent or user to invoke the skill under false assumptions, mishandle outputs, or route sensitive operational data into an unrelated review workflow, increasing the chance of unsafe automation and incorrect security decisions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description explicitly says '支持中文交互' and presents the skill as Chinese-interaction oriented, but does not offer an opt-in or alternative language choice. Under the language/locale policy, forcing or presuming a specific language without user choice can be a policy concern unless clearly justified.

Content

No source excerpt is available for this finding.