ClawHub
Back to skill

Security audit

exoplanet-workflows

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward exoplanet-analysis guidance document, with only a minor dependency-installation caution.

Install the listed Python packages in a virtual environment or container, preferably with pinned versions if reproducibility matters. The skill itself is guidance-only and does not contain executable bundled code.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:198
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 198-202
Vulnerability Type: Supply-chain risk from mutable, unverified dependencies
Risk Level: Medium

The skill recommends the following installation command:

markdown
## Dependencies

```bash
pip install lightkurve transitleastsquares numpy matplotlib scipy
text

### Technical Analysis

The command installs five third-party Python packages without pinned versions, package hashes, a lock file, or an explicitly trusted package index. Consequently, dependency resolution is mutable: the artifacts and transitive dependencies installed at execution time may differ from those reviewed when the skill was published.

Python package installation can execute package-controlled build and installation logic. If a named package, one of its transitive dependencies, or the package repository is compromised, following this instruction could cause attacker-controlled code to run during installation or later import. This finding does not establish that any listed package is currently malicious; it identifies an unsafe dependency acquisition practice.

### Attack Path

1. A user or agent follows the dependency installation instruction.
2. `pip` resolves the latest compatible releases and their transitive dependencies from its configured package index.
3. An attacker compromises a package release, maintainer account, transitive dependency, or relevant distribution channel.
4. `pip` downloads the compromised artifact because no reviewed versions or hashes constrain resolution.
5. Malicious package logic executes during build or installation, or when the package is subsequently imported by an analysis workflow.
6. The payload operates with the permissions and environment access of the account running `pip`.

### Impact Assessment

Successful exploitation could permit arbitrary code execution with the privileges of the installing user or agent. Depending on that a
...[truncated 361 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin all direct and transitive dependencies to reviewed versions in a lock file.
  2. Require cryptographic hashes, for example with:
    bash
    python -m pip install --require-hashes -r requirements.txt
  3. Generate the requirements file through a controlled dependency-resolution process and review dependency changes before updating it.
  4. Configure an explicitly trusted package index or an internally controlled package mirror.
  5. Install dependencies in an isolated virtual environment or container under a non-privileged account.
  6. Avoid running pip as root or with administrative privileges.
  7. Scan pinned packages and transitive dependencies for known vulnerabilities and provenance concerns.
  8. Rebuild and verify the lock file periodically through a documented update process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.