weather character skill

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:01 AM UTC
• Version: 1.0.0

Overview

This skill describes a weather-themed character image generator with disclosed scheduling and package-install steps, but the package is incomplete and should be installed cautiously.

Before installing, be aware this artifact only contains SKILL.md and references implementation files that were not included for review. Use a virtual environment, pin dependency versions if possible, and review any weather_character.py or scheduler.py implementation before running a daily scheduled task.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Third-Party Dependencies Allow Mutable Supply-Chain Inputs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–24
Vulnerability Type: Unpinned and unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

# Install
pip install requests schedule

Technical Analysis

The installation instructions retrieve requests and schedule without specifying reviewed versions, package hashes, a lockfile, or a trusted package index. Consequently, the installed artifacts can change after the skill has been audited.

Package resolution depends on the user's active Python package index and environment configuration. If an index, package release, or dependency in the resolution chain is compromised, following these instructions may install attacker-controlled code. Python packages can execute code during installation or when imported by the referenced application.

The project contains no dependency manifest or integrity metadata that would allow users to reproduce or verify the dependency set.

Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, or a package index configured in the user's environment.
2. The attacker publishes a malicious package version or substitutes a malicious distribution artifact.
3. A user follows the Quick Start instructions and runs pip install requests schedule.
4. pip resolves the mutable dependency set and downloads the attacker-controlled artifact without hash verification.
5. Malicious code executes during package installation or when the package is subsequently imported by the application.

Impact Assessment

Malicious dependency code would generally execute with the privileges of the user running pip or the application. It could access files, environment variables, credentials, and network resources available to that account; alter the Python environment; or execute additional commands. If installation is performed with elevated privileges, the po ...[truncated 225 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct and transitive dependency to a reviewed version in a requirements or lock file.
2. Record cryptographic hashes for all distribution artifacts and install with hash enforcement, such as:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Generate the locked dependency set through a reproducible process and review it before release.
4. Explicitly document and enforce a trusted package index rather than relying on ambient pip configuration.
5. Install dependencies in an isolated virtual environment without administrator privileges.
6. Add automated dependency vulnerability and provenance checks to the release process.
7. Include the referenced implementation files so their imports and actual dependency requirements can be audited.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.