Code Dev V1

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:26 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed development and release workflow helper, with broad but purpose-aligned command and release-management capabilities.

Install only if you want a Chinese-language skill that can guide agents through repository changes, Git tagging, changelog generation, audits, and release checks. Review any exec, deployment, rollback, or CI/CD credential use before running it, and prefer pinned dependency installs in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:337

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 337–339
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

markdown

| ruff(可选) | Linter | 规范检查 | `pip install ruff` |
| pytest(可选) | 测试框架 | 测试覆盖 | `pip install pytest` |
| mypy(可选) | 类型检查 | 类型门禁 | `pip install mypy` |

Technical Analysis

The skill recommends installing ruff, pytest, and mypy without pinning reviewed versions or verifying package hashes. These commands resolve mutable package versions through the user's configured Python package index. The instructions do not provide a lockfile, constraints file, trusted-index restriction, or hash verification.

Although these are established packages and the document describes them as optional, installation is not reproducible and remains dependent on the integrity of future releases, the selected package index, and the user's pip configuration. If a package release or configured index is compromised, installation or later invocation of the tools could execute attacker-controlled code.

Attack Path

1. A user or AI agent follows the dependency instructions in SKILL.md.
2. It executes one or more unpinned pip install commands.
3. Pip resolves the current package release from its configured index, which may include an untrusted or compromised mirror.
4. A malicious or compromised package artifact is downloaded and installed.
5. Attacker-controlled code may execute during package installation or when the installed quality tool is subsequently invoked.

This attack requires compromise or malicious control of a resolved package release, package index, mirror, or relevant local pip configuration.

Impact Assessment

Malicious package code would generally execute with the privileges of the account running pip or invoking the installed tool. Potential impact includes:

• Reading or modifying files available to that user.
• Accessing source code and project configuration.
• Re ...[truncated 408 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed, exact version, for example:

   text

   ruff==<reviewed-version>
   pytest==<reviewed-version>
   mypy==<reviewed-version>
   

2. Generate and maintain a lockfile or constraints file containing cryptographic hashes. Install with hash enforcement, such as:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

3. Explicitly use an approved package index and prevent unintended fallback to untrusted extra indexes.

4. Install dependencies inside an isolated virtual environment or ephemeral CI container under a non-privileged account.

5. Scan dependency versions and transitive dependencies for known vulnerabilities before approving updates.

6. Establish a controlled update process in which new versions and hashes are reviewed, tested, and committed before use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly enables command execution and describes release/deployment workflows that can modify repositories, environments, tags, files, and potentially production systems, but it does not present clear safety warnings, confirmation requirements, or execution boundaries. In a tool intended for enterprise development and multi-environment release management, this omission increases the risk that users or downstream agents will treat destructive or system-altering actions as routine and execute them without adequate review.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill name, description, instructions, examples, and operational guidance are all presented only in Chinese. Because no user opt-in, alternative language option, or explicit region-specific justification is provided, this creates a language/locale policy concern under the natural-language policy rules.

Content

No source excerpt is available for this finding.