Pywayne Cv Apriltag Detector

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:33 PM UTC
• Version: 0.1.0

Overview

The skill is for AprilTag detection, but it may automatically install an unpinned third-party library at runtime, so users should review it before use.

Install or run this only in a virtual environment or other contained workspace, and consider preinstalling a reviewed, pinned apriltag_detection dependency yourself. Be aware that first use may download and install third-party code through gettool with the same permissions as the running agent.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54
• Finding: Automatic Installation of an Unverified Third-Party Dependency<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 54-61 **Vulnerability Type**: Unverified automatic dependency retrieval and installation **Risk Level**: Medium ### Vulnerable Snippet ```markdown ## Requirements - `cv2` (OpenCV) - Image processing - `numpy` - Array operations - `gettool` - Downloads apriltag_detection library automatically ## Library Installation The detector automatically checks for and installs the `apriltag_detection` library using `gettool` if not found. ``` ### Technical Analysis The Skill documents automatic retrieval and installation of the `apriltag_detection` dependency through `gettool`. It does not identify an authenticated package source, pin an exact version, specify an integrity hash or signature, or require user confirmation before installation. This creates a software supply-chain risk because the installed component can change independently after the Skill has been reviewed. An attacker who compromises the package source, publishes a malicious package that satisfies the dependency lookup, or otherwise manipulates dependency resolution could cause attacker-controlled installation or package initialization code to execute. The project contains only `SKILL.md`; therefore, the implementation of `gettool` and the precise installation mechanism could not be inspected. There is no evidence that this Skill intentionally retrieves a malicious payload, but the documented dependency process lacks verifiable safeguards. ### Attack Path 1. The user invokes `ApriltagCornerDetector` in an environment where `apriltag_detection` is unavailable. 2. The detector triggers the documented automatic installation process through `gettool`. 3. Dependency resolution reaches an unsafe or compromised source, or resolves an attacker-controlled package or release. 4. The malicious package is downloaded without a documented version pin, signature check, or hash verification. 5. Installation hooks, import-time initialization ...[truncated 786 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable automatic installation during detector initialization and require dependencies to be installed explicitly before runtime. 2. Pin `apriltag_detection` to a reviewed, immutable version rather than accepting the latest or an unspecified release. 3. Retrieve the dependency exclusively from an authenticated, explicitly documented repository. 4. Verify a cryptographic hash or trusted digital signature before installation. 5. Use a lockfile or equivalent reproducible dependency manifest containing exact versions and integrity metadata. 6. Require explicit user approval before any network retrieval or package installation. 7. Install the dependency in an isolated virtual environment or sandbox with minimal filesystem, credential, and network access. 8. Document the exact package identifier, source URL, expected publisher, version, and integrity value so users can independently verify the artifact. 9. Review `gettool` and the detector implementation to confirm that dependency names and installation arguments cannot be influenced by untrusted input. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states that it will automatically install the `apriltag_detection` library via `gettool` if it is not already present, but it does not clearly warn users that running the skill may trigger network access, dependency downloads, and local environment modification. This is dangerous because it creates an implicit supply-chain and execution risk: users may invoke what appears to be a detection utility without realizing it can fetch and install code at runtime.

Static analysis

No suspicious patterns detected.