Py Data Analyzer Free

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.0

Overview

This is a data-analysis guidance skill whose command, file, and dependency use mostly fits its stated purpose, but users should keep execution and exports under explicit control.

Install only if you are comfortable letting the agent read datasets, run Python analysis code, and potentially create output files when you explicitly ask for that. Do not provide a callback URL unless you intentionally want external notification, and prefer pinned dependencies in a virtual environment for real or sensitive data work.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:289

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 289–292
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

text

| pandas | Library | Required | pip install pandas |
| numpy | Library | Required | pip install numpy |
| matplotlib | Library | Recommended | pip install matplotlib |
| seaborn | Library | Recommended | pip install seaborn |

Technical Analysis

The Skill recommends installing third-party Python packages without fixed versions, cryptographic hashes, a lock file, or an explicitly trusted package index. Although the listed package names are recognizable and show no evidence of typosquatting, each command resolves mutable package versions from the runtime's configured Python package index.

Consequently, the installed code is not the same immutable artifact reviewed during this audit. A compromised package release, transitive dependency, or configured package mirror could introduce malicious code. Python package code may execute during installation, and installed modules may execute additional code when imported. The exposure is amplified by the Skill's declared exec capability.

Attack Path

1. A user requests a data-analysis operation supported by the Skill.
2. The Agent follows the dependency instructions and executes one or more unpinned pip install commands.
3. pip resolves the current package versions and transitive dependencies using the environment's configured package index.
4. An attacker compromises a package release, one of its transitive dependencies, or the configured mirror.
5. The compromised package is downloaded and installed because no version or hash validation constrains the artifact.
6. Malicious code executes during installation or when the package is subsequently imported by generated analysis code.

Impact Assessment

Malicious dependency code could run with the same operating-system identity and privileges as the Agent or u ...[truncated 558 chars]

Remediation

View remediation

Remediation Suggestions

1. Move dependencies into a reviewed requirements or lock file and pin exact versions.
2. Record cryptographic hashes for every direct and transitive dependency.
3. Install with hash enforcement, for example:

bash

python -m pip install --require-hashes -r requirements.txt

4. Configure and document an approved package index rather than relying on ambient pip configuration.
5. Generate dependencies from a trusted build process and regularly scan them for known vulnerabilities.
6. Install packages in an isolated virtual environment or container under a least-privilege account.
7. Avoid granting the analysis process access to unrelated credentials, sensitive files, or unnecessary network resources.
8. Review and deliberately update pinned versions instead of resolving the newest available versions at execution time.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest and description present this as a knowledge-base guidance skill, but the body expands scope to creation/export actions and explicitly enables exec-driven behavior. That mismatch can cause an agent or user to grant broader privileges than expected, increasing the chance of unintended code execution or file manipulation in a context that appears informational only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The documentation mentions create/query/export operations and the manifest enables write-capable tools without clearly warning that the skill may modify or emit data. In a data-analysis context, users may expect read-only assistance, so silent write/export capability increases the risk of accidental overwrites, unauthorized file creation, or data leakage through exported artifacts.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation guidance says to use the skill whenever data analysis, report generation, statistical insights, or visualization are needed, which is a very broad description rather than a specific trigger set. It does not provide concrete constraints or negative examples beyond a generic exclusion, so the skill could be invoked for many ordinary requests that only loosely relate to analysis.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill claims to be a pure knowledge-base skill with no extra dependency or installation burden, while elsewhere stating some functions require exec-based command execution. This inconsistency can mislead policy engines and users into enabling execution in a trust context intended only for static guidance, weakening least-privilege assumptions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented callback_url introduces a network-capable workflow that is not necessary for a local data-analysis knowledge skill. Even if not implemented here, advertising callback behavior can lead agents or wrappers to transmit results or metadata to external endpoints, creating exfiltration and SSRF-style risk when users supply arbitrary URLs.

Content

No source excerpt is available for this finding.