box-least-squares

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:18 AM UTC
• Version: 0.1.0

Overview

This is a straightforward astronomy analysis guide with expected package installation guidance and no hidden execution, persistence, or data access behavior.

Install the listed Python packages in a dedicated virtual environment and avoid running pip with administrator privileges. The skill itself is a guide, not an executable tool, and its examples operate on local light-curve data you provide.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:293

Finding

Unpinned Third-Party Dependencies Installed from Mutable Package Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 293-295
Vulnerability Type: Unpinned and unhashed third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install astropy numpy matplotlib
# Optional: lightkurve for preprocessing
pip install lightkurve

A similar unpinned installation instruction also appears at SKILL.md:29:

bash

pip install astropy

Technical Analysis

The installation instructions retrieve mutable package versions and their transitive dependencies from the package index configured for pip. They do not specify reviewed versions, verify package hashes, use a lockfile, or constrain the package source to an explicitly trusted index.

This makes the installation non-reproducible and exposes users to supply-chain risks. A compromised upstream release, compromised package index, dependency confusion condition, or malicious transitive dependency could introduce code that was not present when the Skill was reviewed. Python packages can execute build-system or installation-related code, while installed packages execute with the privileges of the Python environment when imported or invoked.

The listed package names do not appear to be typosquatted, and the audit found no evidence that the Skill intentionally selects malicious packages. The risk arises from the unsafe dependency installation pattern rather than a confirmed malicious dependency.

Attack Path

1. A user follows the dependency installation instructions in SKILL.md.
2. pip resolves the latest available versions from the user's configured package index and recursively resolves transitive dependencies.
3. An upstream package, transitive dependency, configured mirror, or package-index account is compromised, or an unexpected incompatible release is published.
4. pip downloads and installs the altered package without validating it against a project-controlled version lock ...[truncated 934 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin all direct dependencies to reviewed versions rather than installing unconstrained latest releases.
2. Generate and commit a lockfile that includes fully resolved transitive dependency versions.
3. Require cryptographic hashes, for example through a hashed requirements file installed with pip install --require-hashes -r requirements.txt.
4. Explicitly use a trusted package index and avoid unreviewed mirrors or additional indexes.
5. Recommend installation in a dedicated virtual environment with least-privilege user permissions.
6. Add automated dependency vulnerability and integrity scanning to the maintenance process.
7. Review and update pinned versions on a controlled schedule rather than allowing versions to change implicitly at installation time.
8. Avoid running package installation commands with administrator or root privileges.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.