Pywayne Cv Camera Model

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:33 PM UTC
• Version: 0.1.0

Overview

The skill is mostly coherent, but it documents automatically downloading a native camera library without explaining source or integrity checks.

Before installing, confirm where gettool downloads camera_models from, whether the exact version is pinned, and whether a checksum or signature is verified before the native library is loaded.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:105

Finding

Unverified Automatic Download of a Native Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 105-112
Vulnerability Type: Unverified automatic retrieval of a third-party native library
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Requirements

- `camera_models` - C++ library (auto-downloaded via gettool if missing)
- `numpy` - Array operations
- `pywayne.cv.tools.write_cv_yaml` - For writing YAML files

## Notes

- Library is automatically checked and downloaded via `gettool` if not found

Technical Analysis

The documented workflow automatically downloads the native camera_models C++ library through gettool when the dependency is unavailable. The documentation does not specify an authoritative download URL, an immutable version, a cryptographic checksum, a digital signature, or an explicit user-approval step.

Because a native library executes inside the importing process, substitution or compromise of the dependency source could result in arbitrary native code execution. The reviewed project contains only SKILL.md; therefore, the implementation of gettool, its transport protections, and any artifact-integrity verification could not be inspected. The finding is consequently based on the explicitly documented automatic-download behavior and missing documented safeguards, not on a confirmed malicious payload.

Attack Path

1. A user follows the documented workflow and imports or initializes the camera-model wrapper.
2. The expected camera_models native library is not present locally.
3. The wrapper automatically invokes gettool to retrieve an unspecified dependency artifact.
4. An attacker compromises or controls the artifact source, resolution process, network path, or mutable upstream release.
5. Without checksum or signature verification, the substituted native library is accepted.
6. The malicious library is loaded into the Python process and executes with that process's permissions.

Impac

...[truncated 585 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin camera_models to an exact, immutable release rather than resolving a mutable or unspecified version.
2. Restrict downloads to a documented, trusted HTTPS source under the maintainers' control.
3. Publish and verify a cryptographic checksum, such as SHA-256, before loading the downloaded artifact.
4. Prefer signed release artifacts and validate signatures against a pinned, trusted signing key.
5. Fail closed if integrity or authenticity verification fails.
6. Require explicit user consent before downloading or loading native code; preferably require dependency installation as a separate administrative step.
7. Cache artifacts only after successful verification and protect the cache against unauthorized modification.
8. Record the resolved source, version, checksum, and verification outcome for auditing and reproducible builds.
9. Document the dependency acquisition and integrity controls in SKILL.md.
10. Review the unavailable gettool implementation to confirm secure transport, strict source allowlisting, integrity validation, safe archive extraction, and resistance to dependency confusion.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.