Pywayne Vio Tools

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:51 PM UTC
• Version: 0.1.2

Overview

This skill is a small VIO data-conversion and visualization guide with no bundled executable code, but users should install its Python dependencies cautiously.

Install dependencies in a virtual environment, avoid running pip as root, and consider pinning reviewed package versions before using the examples. Also verify that pywayne.vio.tools comes from the intended source, since the artifact is documentation only and does not include that implementation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:89

Finding

Unpinned Third-Party Dependencies Installed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 89–98
Vulnerability Type: Supply-chain exposure through unpinned and unverified Python dependencies
Risk Level: Medium

Vulnerable Code

markdown

## Dependencies

Required packages:
- `numpy` - Array operations
- `qmt` - Quaternion utilities
- `ahrs` - Quaternion class
- `matplotlib` - 3D visualization

Install with:
```bash
pip install numpy qmt ahrs matplotlib

text

### Technical Analysis

The documented installation command retrieves mutable versions of four third-party packages from the Python package index configured in the user's environment. No exact versions, cryptographic hashes, lockfile, or trusted index URL are specified.

This makes installation non-reproducible and prevents users from verifying that installed artifacts match versions reviewed by the project author. If a package release or configured package index is compromised, pip may download attacker-controlled content. Source distributions can invoke build backends during installation, while malicious package code can execute when imported or used.

The project contains only `SKILL.md`; it does not include the implementation of `pywayne.vio.tools` or dependency metadata that would allow the documented code and its dependency graph to be audited or reproduced.

### Attack Path

1. A user follows the documented command:
   ```bash
   pip install numpy qmt ahrs matplotlib

2. Pip resolves the latest compatible packages using the environment's configured index and dependency resolver.
3. An attacker compromises a referenced package release, one of its transitive dependencies, or an untrusted package index configured on the system.
4. Pip downloads and installs the attacker-controlled distribution because no approved versions or hashes are enforced.
5. Malicious behavior executes through package build logic, or later when the dependency is imported by the documented VIO workflow.
6. The payload operates with the ...[truncated 837 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every direct dependency to a reviewed version rather than allowing unconstrained resolution.
2. Generate a lock or requirements file containing all direct and transitive dependencies.
3. Record cryptographic hashes for every permitted distribution and enforce them:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

4. Prefer a controlled internal mirror or explicitly document and enforce the trusted package index.
5. Review new dependency versions before updating pins, and automate vulnerability and provenance scanning in CI.
6. Install dependencies inside an isolated virtual environment or container under a non-privileged account.
7. Include the source implementation of pywayne.vio.tools, or provide a verifiable source and release reference, so users can confirm that the imported module corresponds to the audited implementation.
8. Avoid privileged pip installation and disable unnecessary access to secrets and production resources during dependency installation.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep