Pywayne Visualization Rerun Utils

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:22 PM UTC
• Version: 0.1.0

Overview

This skill is a small Rerun visualization helper guide with no bundled executable code, though its external SDK dependency should be installed from a trusted source.

This appears reasonable to install for Rerun-based 3D visualization. Before use, make sure gettool resolves the Rerun SDK from a trusted source, prefer a pinned reviewed version where possible, and only pass image or data paths you intend to visualize.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:99

Finding

Unpinned Automatically Downloaded Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 99
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable snippet:

markdown

- **Dependencies**: Requires Rerun SDK (auto-downloaded via `gettool`)

Technical Analysis

The skill states that the Rerun SDK is automatically downloaded through gettool, but it does not specify an authoritative registry or source URL, an exact immutable version, a cryptographic hash, or a signature-verification procedure.

Consequently, the dependency resolved at execution time may differ from the component that was originally reviewed. If the package source, resolution process, publisher account, or downloaded artifact is compromised, a malicious dependency could execute code during installation or subsequent import. The project itself contains no bundled executable scripts; this risk arises from the documented external dependency acquisition process.

Attack Path

1. An attacker compromises or substitutes the dependency available through the source used by gettool, or otherwise influences resolution toward a malicious artifact.
2. A user follows the skill instructions and invokes functionality requiring the Rerun SDK.
3. gettool automatically retrieves the dependency without a documented immutable version or integrity check.
4. Malicious installation hooks or imported package code execute in the Agent's environment.
5. The payload operates with the permissions available to the Agent process.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the current Agent or user process privileges. Depending on that environment's permissions, the malicious component could access files, environment variables, network resources, or other data available to the process and could alter task results. The documentation does not establish privilege escalation, persistence, credential theft, or exfiltration b ...[truncated 68 chars]

Remediation

View remediation

Remediation Suggestions

1. Identify and document the official package registry and publisher from which the Rerun SDK must be obtained.
2. Pin the dependency to an exact, reviewed version rather than resolving the latest available release automatically.
3. Verify downloaded artifacts using an approved cryptographic hash or publisher signature.
4. Generate and enforce a lockfile or hash-locked requirements file where supported.
5. Avoid implicit downloads during skill execution; require dependencies to be installed through a separate, reviewable setup step.
6. Perform installation in an isolated, least-privileged environment and prevent unnecessary access to secrets and sensitive files.
7. Review dependency updates before changing the pinned version and retain provenance information for the approved artifact.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.