T09 · Insecure Skill Coding Practices
Error
- Location
scripts/write.py:10- Finding
Dataset Name Path Traversal Enables Writes Outside the Storage Directory
- Content
View full analysis
- Remediation
View remediation
Security audit
Lance Store
Security checks for vulnerabilities and agentic risk
Overview
This skill is a local persistent data store, but its code can write or delete data more broadly than users may expect and lacks strong safeguards for destructive actions.
Review before installing. Use this only in an isolated workspace, avoid storing secrets or sensitive personal data, require explicit user confirmation before delete/drop operations, and fix dataset-name and backup-path validation before trusting it with important data. Pin dependencies or install from a reviewed lockfile.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/manage.py:41- Finding
Backup Path Validation Can Be Bypassed Through Symbolic Links
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/manage.py:116- Finding
Dataset Drop Operation Bypasses the Documented Confirmation Safeguard
- Content
View full analysis
``` ``` ### Technical Analysis The documentation claims that confirmation is required when a backup has not been created. The implementation neither requests confirmation nor verifies the presence or validity of a backup. Once the command is invoked, `shutil.rmtree()` recursively deletes the entire dataset directory. The corresponding metadata is then removed and the metadata dataset is overwritten. There is no recovery mechanism or transactiona ...[truncated 875 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Runtime Dependencies Are Installed Without Version or Integrity Pinning
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/write.py:10- Finding
User-Defined Schema Fields Can Override Internal Record Identifiers and Timestamps
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill is presented as a benign persistence/query utility, but the documented behavior includes destructive dataset deletion, backup to arbitrary filesystem paths, and disclosure of dataset paths. This mismatch can cause agents or users to invoke the skill under a lower-risk assumption, enabling data loss or unintended filesystem interactions that exceed the apparent purpose.
- Content
Ae2
Medium
- Category
- analysis-evasion
- Confidence
- 90% confidence
- Finding
Artifact content does not match its filename extension
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill documents persistent storage, backup, deletion, and path-related operations, which imply filesystem write capability, but it declares no explicit tool scope or permissions boundary. In an agent environment, this creates an authorization gap where the orchestrator or user may not realize the skill can modify local state, increasing the chance of unintended file writes or destructive actions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are extremely broad, including common language such as 'remember this' and 'store for later', which can cause accidental invocation during ordinary conversation. Because the skill persists data across sessions, overbroad activation increases the risk of silently storing sensitive user content or triggering filesystem writes without sufficiently informed intent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The documentation includes delete and drop operations, and mentions backup only as a soft requirement, but does not provide strong user warnings about irreversible data loss or mandatory confirmation semantics. In a conversational agent setting, this makes destructive actions easier to invoke casually, especially if the skill is auto-selected from broad triggers.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The
delete-dataset-recordcommand performs deletion of dataset content, which can affect user data. In this file there is no confirmation prompt, warning output, or explanatory comment/docstring notifying users about the destructive action.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code exposes a
drop-datasetcommand described as deleting a dataset and its metadata entry, which is a destructive operation. The file provides no confirmation prompt, warning print/log, or inline comment/docstring disclosing the irreversible action before execution.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The drop_dataset function deletes the dataset directory with shutil.rmtree and overwrites metadata, which is a destructive and potentially irreversible operation. Although the function has internal comments, there is no user-facing confirmation prompt, warning message, or disclosure in this file indicating that data will be removed.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The function rewrites the entire dataset using overwrite mode after modifying a record, which is a safety-critical file write with irreversible impact if the wrong record or dataset is targeted. The file contains internal comments, but no user-facing confirmation, logging/print disclosure, or other visible warning in this code about the overwrite behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This code deletes a record and then persists the change by overwriting the dataset, which is a destructive operation affecting stored user data. There is no confirmation prompt, print/log disclosure, docstring, or other user-visible warning in this file indicating that data will be removed and the dataset rewritten.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The dependency 'pylance' is unpinned, so installs can resolve to different versions over time, including buggy or compromised releases. In a skill that persists and queries structured data across sessions, dependency drift can introduce supply-chain risk and unpredictable behavior in a trusted data-handling component.
- Content
text # Lance columnar format — PyPI package is 'pylance' but installs as the 'lance' module. # This is the official Lance project naming convention (see https://github.com/lance-format/lance). # Do NOT replace 'pylance' with 'lance' here — 'lance' is not a valid PyPI package name. pylance pandas
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency 'pandas' is unpinned, allowing environment-dependent resolution to any available version, which increases the risk of pulling vulnerable or incompatible releases. Because this skill is meant to store and analyze user data, a compromised or unexpectedly changed data-processing library could affect confidentiality, integrity, or availability.
- Content
text # This is the official Lance project naming convention (see https://github.com/lance-format/lance). # Do NOT replace 'pylance' with 'lance' here — 'lance' is not a valid PyPI package name. pylance pandas
Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The manifest includes 'pandas' without a version pin, and there is at least one known advisory affecting some historical releases; without pinning, it is impossible to verify whether installation will select an affected version. Although the cited CVE is disputed and may require unsafe deserialization usage elsewhere in the code, the lack of version control still creates avoidable exposure and uncertainty.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The backup_dataset function creates directories with os.makedirs and copies dataset contents with shutil.copytree, modifying the filesystem. While the code has internal comments, there is no user-facing print/log message, prompt, or other disclosure in this file that a backup directory will be created and files copied.
- Content
Static analysis
No suspicious patterns detected.