社交情感分析免费版

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:28 AM UTC
• Version: 1.0.1

Overview

This is mainly a CSV-based social sentiment analysis guide, with no bundled executable payload, but its documentation is inconsistent about data collection, LLM use, and dependency setup.

Install only if you intend to run local Python-based sentiment analysis on CSV social-media data. Keep data collection manual or explicitly approved, avoid providing platform API keys unless you understand the platform terms, and do not send CSV contents to an LLM or callback URL unless that is intentional.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:238

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 238 and 451
Vulnerability Type: Unpinned and unverifiable third-party dependency installation
Risk Level: Medium

Vulnerable Code

At line 238:

bash

pip3 install pandas

The same installation instruction is repeated at line 451:

markdown

| pandas | Python library | Required | `pip3 install pandas` |

Technical Analysis

The Skill instructs the Agent to install pandas without specifying an exact version, package hash, lockfile, or trusted package index. Consequently, the package and its transitive dependencies are resolved dynamically from the Python package index configured in the execution environment.

This makes installation results mutable and prevents verification that the installed artifacts are the same artifacts reviewed or tested by the Skill author. If the configured index, a future package release, or a transitive dependency is compromised, package installation can introduce attacker-controlled code into the Agent environment.

No evidence was found that the current pandas package or its dependencies are compromised. The vulnerability is the Skill's unsafe and non-reproducible dependency acquisition process.

Attack Path

1. An Agent loads the Skill and follows its dependency setup instructions.
2. The Agent executes pip3 install pandas.
3. pip contacts the package index configured in the environment and dynamically resolves the latest compatible package and transitive dependencies.
4. An attacker who has compromised a resolved package release, dependency, package index, or index configuration supplies a malicious distribution.
5. The malicious component executes during installation or when the installed library is subsequently imported.
6. The payload operates with the privileges and environmental access of the Agent process.

Impact Assessment

Successful supply-chain exploitation could permi ...[truncated 691 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin pandas and every transitive dependency to reviewed, exact versions.
2. Store dependencies in a lockfile or hash-locked requirements file, for example:

   text

   pandas==<reviewed-version> --hash=sha256:<verified-wheel-hash>
   

3. Install with hash enforcement:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Explicitly select an approved HTTPS package index and disable unintended additional indexes to reduce dependency-confusion exposure.
5. Prefer pre-reviewed binary wheels from a controlled artifact repository.
6. Perform dependency vulnerability and provenance scanning before publishing updates.
7. Run package installation and analysis in an isolated virtual environment or sandbox with minimal filesystem, credential, and network access.
8. Replace both unpinned installation instructions in SKILL.md with the same reproducible, verified installation procedure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest advertises single-platform social-media data collection as a core capability, but the body later says the free version does not include built-in collection and only analyzes user-supplied CSVs. This mismatch can cause an agent or user to over-trust the skill's data-access scope and approve broader permissions or workflows than are actually needed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation contradicts itself about whether built-in data collection is supported. In an agent context, contradictory operational claims are dangerous because they can trigger incorrect tool use, confuse trust decisions, and obscure whether network access or external API interaction will occur.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states the free edition does not support LLM-enhanced sentiment analysis, yet later declares an LLM API as required for theme extraction and result interpretation. This inconsistency can mislead users and agents into invoking unexpected model-backed processing, which may send sensitive social-media content to an LLM or enable capabilities the user did not intend to use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is overly broad, telling agents to use the skill whenever data analysis, report generation, statistical insight, or visualization is needed. Such generic routing language can cause the skill to hijack unrelated requests, increasing the chance of inappropriate execution, unnecessary file handling, or use with sensitive datasets outside its stated niche.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill processes social-media text and may optionally involve API-based collection, yet it lacks clear warnings about privacy, sensitive personal data, and third-party data transfer risks. In this context, that omission is material because users may provide identifiable public-post data or configure external APIs without understanding retention, consent, or disclosure implications.

Content

No source excerpt is available for this finding.