Pywayne Vio So3

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:21 PM UTC
• Version: 0.1.0

Overview

This is a straightforward Python rotation-math skill, with only a dependency-pinning caution to consider before installation.

Install this in an isolated virtual environment and consider pinning reviewed versions of `numpy`, `qmt`, and `scipy` before use. The skill itself appears limited to documented SO(3) rotation utilities and does not request sensitive access or persistent privileges.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:130

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 130-139
Vulnerability Type: Unpinned and unhashed third-party dependencies
Risk Level: Medium

markdown

## Dependencies

Required packages:
- `numpy` - Array operations
- `qmt` - Quaternion utilities
- `scipy` - Rotation averaging

Install with:
```bash
pip install numpy qmt scipy

Technical Analysis

The installation instructions resolve numpy, qmt, and scipy without fixed versions or cryptographic hashes. Consequently, the installed artifacts can change over time and depend on the configured package index, resolver state, platform, and transitive dependency versions.

Python package installation may execute package-controlled build hooks when a source distribution must be built. If a package release, transitive dependency, configured package index, or package maintainer account is compromised, following this command could install attacker-controlled code. No malicious dependency is demonstrated in the audited file; the risk arises from the unconstrained supply-chain trust model.

Attack Path

1. An attacker compromises a dependency release, a transitive dependency, a package-publishing account, or a package index configured in the target environment.
2. The attacker publishes or serves a malicious package version that remains compatible with the unconstrained package names.
3. A user or agent follows the Skill documentation and runs pip install numpy qmt scipy.
4. pip resolves the attacker-controlled version because no approved versions or hashes are specified.
5. Malicious build hooks may execute during installation, or malicious runtime code may execute when the installed package is imported.
6. The payload runs with the permissions of the account performing the installation or invoking the package.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing or runtime us ...[truncated 415 chars]

Remediation

View remediation

Remediation Suggestions

• Replace unconstrained package installation with reviewed, exact version pins.
• Maintain dependencies in a lockfile generated through a controlled review process.
• Require cryptographic hashes for downloaded artifacts, such as by using pip install --require-hashes -r requirements.txt.
• Include and pin all relevant transitive dependencies where the selected package-management workflow supports it.
• Download packages only from an explicitly approved HTTPS package index; prevent fallback to untrusted indexes or mirrors.
• Review package provenance, maintainer history, release signatures or attestations where available, and vulnerability advisories before updating versions.
• Install dependencies inside an isolated virtual environment or container under a non-privileged account.
• Prefer prebuilt, verified wheels and restrict source builds where operationally feasible.
• Automate dependency scanning and controlled lockfile updates so security patches can be adopted without reverting to unconstrained installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.