ClawHub
Back to skill

Security audit

transit-least-squares

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward guide for using a scientific exoplanet transit-detection Python library, with no hidden execution or unrelated data access found.

Install the dependencies in an isolated virtual environment and consider pinning reviewed versions, especially on shared or production systems. Review the scientific packages you install, but the skill itself is just usage guidance for TLS analysis.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:24
Finding

Unpinned Installation of the Transit Least Squares Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install transitleastsquares

Technical Analysis

The installation instruction retrieves the latest available version of transitleastsquares without a version constraint, lock file, package hash, or explicitly trusted package index. Consequently, the code installed by users may differ from the dependency version that was available when the Skill was audited.

Python package installation can execute package build or installation logic. Installed packages also execute code when imported or used. If the package, one of its transitive dependencies, or the selected package index is compromised, following this instruction could introduce attacker-controlled code into the user's environment.

This finding does not establish that the named package is currently malicious. The risk arises from mutable and unverified dependency resolution.

Attack Path

  1. An attacker compromises a future release of transitleastsquares, a transitive dependency, or the package distribution channel.
  2. The user follows the documented unpinned pip install command.
  3. pip resolves and downloads the compromised version because no reviewed version or integrity hash is required.
  4. Malicious code executes during package build, installation, import, or subsequent TLS processing.
  5. The code operates with the privileges of the user or service running pip and the Python workflow.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's permissions, an attacker could read or alter accessible scientific data, credentials, Python environments, and project files; make outbound network requests; or modify other user-owned resources.

The issue does not itself grant admin ...[truncated 212 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin transitleastsquares to a specifically reviewed version rather than resolving the latest release.
  • Maintain dependencies in a lock file generated by a tool such as pip-tools, Poetry, or uv.
  • Require cryptographic hashes by using a hash-locked requirements file and pip install --require-hashes.
  • Pin and verify transitive dependencies, not only the direct package.
  • Configure an explicitly trusted package index or an internally controlled package mirror.
  • Install dependencies in an isolated virtual environment under a non-privileged account.
  • Scan locked dependency artifacts for known vulnerabilities and review updates before changing pinned versions.

Example hardened installation pattern:

bash
python -m venv .venv
. .venv/bin/activate
python -m pip install --require-hashes -r requirements.txt

T08 · Insecure Dependencies

Warning
Location
SKILL.md:205
Finding

Unpinned Bulk Installation of Scientific Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:205
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash
pip install transitleastsquares lightkurve numpy matplotlib

Technical Analysis

The documented command installs four direct dependencies without fixed versions, integrity hashes, a lock file, or an explicitly trusted package index. It therefore expands the mutable software supply-chain surface beyond the single-package installation instruction.

Package resolution may select newly released direct or transitive dependencies that were not reviewed with this Skill. Python source distributions can run build logic during installation, while installed libraries execute code when imported and used. Compromise of any resolved package or distribution source could therefore lead to execution of attacker-controlled code.

There is no evidence in the audited file that any named package is currently malicious. This finding concerns the absence of reproducible and integrity-verified dependency controls.

Attack Path

  1. An attacker compromises one of the listed packages, a transitive dependency, or the configured Python package index.
  2. A user executes the documented bulk installation command.
  3. pip selects the compromised artifact because the command imposes no reviewed version or hash requirements.
  4. Attacker-controlled logic executes during package build or installation, or when the workflow imports and uses the package.
  5. The malicious code accesses resources available to the user or service account running the installation and analysis.

Impact Assessment

Exploitation could result in arbitrary code execution with the privileges of the installation or runtime account. Exposed resources may include light-curve datasets, project files, environment variables, user credentials, Python environments, and network-accessible services availa ...[truncated 314 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the bulk unpinned installation command with a reviewed, version-locked requirements file.
  • Include hashes for every direct and transitive artifact and enforce them with --require-hashes.
  • Use an explicitly configured trusted index or controlled internal mirror.
  • Prefer pre-reviewed binary wheels where appropriate and disable unexpected source builds in controlled deployments.
  • Install into a dedicated virtual environment or container using a non-administrative account.
  • Run dependency vulnerability and provenance checks as part of release maintenance.
  • Update locked versions through a documented review process rather than automatically consuming the latest releases.

Example requirements structure:

text
transitleastsquares==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH
lightkurve==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH
numpy==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH
matplotlib==REVIEWED_VERSION --hash=sha256:REVIEWED_HASH

All transitive dependencies and applicable distribution artifacts must also be pinned and hashed for --require-hashes enforcement.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.