Cross-Validated Search

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:41 AM UTC
• Version: 16.0.0

Overview

This skill coherently provides web-search and claim-checking commands, with the main caution being an unpinned Python package install.

Install this in an isolated virtual environment as a non-privileged user, and consider pinning the reviewed version, for example cross-validated-search==16.0.0, before use. Expect the tool to send search queries and page-fetch requests to configured search providers as part of normal operation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–21
Vulnerability Type: Unpinned and integrity-unverified dependency installation
Risk Level: Medium

Vulnerable Code

markdown

## Install

```bash
pip install cross-validated-search

text

### Technical Analysis

The installation instructions retrieve `cross-validated-search` from the default Python package index without specifying a version, cryptographic hash, lockfile, or other integrity constraint. Although the Skill metadata declares version `16.0.0`, the installation command does not require that release. Consequently, the package installed may differ from the version intended or reviewed by the Skill author.

Python packages may contain package-controlled build logic and executable runtime components. If the package distribution account, package index, release pipeline, or an unconstrained future release is compromised, following this instruction could install attacker-controlled code. The repository contains only `SKILL.md`, so the dependency's implementation and effective runtime behavior cannot be verified within the audited project.

This finding establishes an insecure supply-chain installation practice; it does not establish that the current PyPI package is malicious.

### Attack Path

1. An attacker compromises the package publisher account, release pipeline, or another component of the package distribution chain.
2. The attacker publishes a malicious release under the legitimate `cross-validated-search` package name.
3. A user follows the documented command:
   ```bash
   pip install cross-validated-search

4. Because no version or artifact hash is specified, pip resolves and downloads the attacker-controlled release.
5. Malicious package logic may execute during installation, depending on the distribution and build path, or when the installed command-line tools are invoked.
6. The payload runs with the privileges and environmental access of the user perform ...[truncated 734 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to the exact reviewed release:

   bash

   python -m pip install "cross-validated-search==16.0.0"
   

2. Generate and publish a hash-locked requirements file, then require hash validation:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Record hashes for every direct and transitive dependency to prevent silent artifact substitution.
4. Verify that the pinned PyPI artifact corresponds to the source revision referenced by the project's homepage.
5. Add the dependency source or a reproducibly verifiable source reference to the audit scope.
6. Install in an isolated virtual environment as a non-privileged user rather than using administrator or root privileges.
7. Use automated dependency monitoring and review each proposed version update before modifying the pin and approved hashes.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.