VecML AutoML

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:34 AM UTC
• Version: 1.1.0

Overview

This AutoML skill mostly matches its stated purpose, but it can send CSV data and the VecML API key to an undocumented environment-controlled endpoint, so users should review it before installing.

Install only if you intend to send the selected CSV data to VecML for cloud processing. Use it with non-sensitive or approved datasets, keep VECML_API_KEY protected, and ensure VECML_API_URL is unset or points only to a trusted HTTPS VecML endpoint before running it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: vecml-pipeline.py:22

Finding

Unrestricted API Endpoint Override Can Disclose API Credentials and User Datasets

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tainted flow: 'req' from os.environ.get (line 34, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 92% confidence

Finding

The API base URL is taken directly from the VECML_API_URL environment variable and then used for outbound requests, while the payload includes the VECML API key and uploaded dataset content. If an attacker can influence the environment, they can redirect requests to an attacker-controlled host and exfiltrate credentials and sensitive CSV data; this is especially risky because the skill’s core function is uploading full datasets to a remote service.

Content

Scanner excerpt · vecml-pipeline.py (reported line 40)May include surrounding context.

python

headers={"Content-Type": "application/json"},
    )
    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            return json.loads(resp.read().decode())
    except urllib.error.HTTPError as e:
        body = e.read().decode()

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger phrases include very broad terms like "train," "predict," "model," "CSV," and "accuracy," which are common in ordinary conversation and many unrelated tasks. This can cause the skill to activate unexpectedly, leading the agent to read user files, request sensitive datasets, or transmit data to an external ML service when the user did not explicitly intend to use this integration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes Python, reads local CSV files, writes prediction outputs, consumes an API key from the environment, and sends data to a remote VecML service, but it does not declare an explicit tool/permission scope. That makes the skill's effective capabilities broader and less transparent to the agent and user, increasing the chance of unintended file access, data exfiltration, or unsafe execution in contexts where tighter scoping should have blocked it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill states that data is uploaded and even base64 encoded, but it does not clearly warn users that their CSV contents are transmitted to a third-party external service. In an AutoML context, CSVs often contain sensitive business, personal, or regulated data, so missing disclosure undermines informed consent and can result in privacy, compliance, or confidentiality violations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The training workflow silently base64-encodes and uploads feature and label data from the user’s CSV to a remote API, but the description and command interface do not clearly warn that local data is being transmitted off-host. In an agent skill context, this can cause unintended disclosure of proprietary or regulated data because users may interpret 'drop a CSV, train a model' as a local operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The predict command writes a _predictions.csv file to disk, which is a file-write side effect. Although the script prints the saved path after writing, there is no prior disclosure in the usage/docstring or argument help that running prediction creates an output file.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.