Security audit

IPO Review

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local IPO filing review tool whose file access and report generation match its stated purpose.

Before installing, remember that the tool processes sensitive IPO materials locally and its generated output files can contain extracted financial facts and source snippets. Use it in a trusted local environment, protect the output directory, and consider pinning dependencies for reproducible installs.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Unpinned Dependencies

Low

Category: Supply Chain
Content: pymupdf>=1.24.0 python-docx>=1.1.0 openpyxl>=3.1.0 pytest>=8.0.0
Confidence: 92% confidence
Finding: The dependency is specified with a lower bound only, which allows future installs to resolve to different versions over time. This weakens build reproducibility and can unintentionally introduce vulnerable or incompatible upstream releases into the skill environment.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pymupdf>=1.24.0 python-docx>=1.1.0 openpyxl>=3.1.0 pytest>=8.0.0
Confidence: 92% confidence
Finding: Using an unpinned minimum version for python-docx permits uncontrolled dependency drift. If a later release contains a security flaw or breaking behavior, fresh environments may silently consume it and affect document-processing workflows.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pymupdf>=1.24.0 python-docx>=1.1.0 openpyxl>=3.1.0 pytest>=8.0.0
Confidence: 92% confidence
Finding: The openpyxl requirement is not pinned to a specific release, so builds are not deterministic and may pull in newly published versions. In a skill that processes spreadsheet-based filing materials, this increases supply-chain and regression risk if upstream behavior changes or a bad release is introduced.

Unpinned Dependencies

Low

Category: Supply Chain
Content: pymupdf>=1.24.0 python-docx>=1.1.0 openpyxl>=3.1.0 pytest>=8.0.0
Confidence: 94% confidence
Finding: The pytest dependency is also unpinned, which means installations can resolve to arbitrary newer versions. Even though pytest is primarily a development/test dependency, unpinned tooling can still introduce vulnerable packages or inconsistent CI behavior.

Static analysis

No suspicious patterns detected.