Security audit

EC Sample Tracker

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent local lab sample tracker, but its import and export behavior can silently alter records or create risky spreadsheet files, so it belongs in Review rather than automatic approval.

Before installing, treat this as a local record system that can permanently change its SQLite database. Back up samples.db before imports, inspect duplicate sample_id values, prefer JSON or Markdown exports for untrusted data, and install optional dashboard dependencies only from a trusted, pinned environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: ec-sample-tracker.py:419
Finding: Spreadsheet Formula Injection in CSV Exports
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: ec-sample-tracker.py:493
Finding: Unpinned Third-Party Dependency Installation Guidance
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The bulk import path uses INSERT OR REPLACE INTO samples, which will silently overwrite any existing record with the same sample_id. In a lab sample-tracking context, this can destroy or alter provenance, status, ownership, and notes without an explicit warning, confirmation step, or audit trail, making accidental data loss or tampering materially harmful.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.