Pandas Skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:56 PM UTC
• Version: 1.0.0

Overview

This is a straightforward pandas data-processing skill with disclosed local file reads and writes, and no evidence of hidden persistence, credential access, or data exfiltration.

Before installing, treat it as a local data-processing toolkit: keep original datasets backed up, write cleaned or transformed data to new output files, review results before using them downstream, and prefer pinned dependency versions if using it in production or with untrusted files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill describes executable scripts that read and write files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap: an agent may invoke file-writing behavior without clear constraints, increasing the chance of unintended overwrites or writes to sensitive paths when the skill is activated.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation condition includes a catch-all trigger for 'any pandas DataFrame operations,' which is overly broad for a skill that provides executable scripts and file transformation workflows. Overbroad activation can cause the agent to load and rely on this skill in many unrelated tabular-data contexts, unnecessarily expanding exposure to file-writing and command-style behaviors.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The file presents the current documentation in Simplified Chinese and labels the alternative as a separate English document, rather than offering language selection within the skill behavior. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The title and instructional content force a specific language locale for users, and there is no indication that Chinese is optional or required for a region-specific purpose. Under the stated policy, natural-language content should not impose a language without user opt-in or clear justification.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code presents its description, CLI help text, status messages, and generated report text in Chinese only. The policy requires flagging language or locale constraints when they are imposed without user opt-in or documented justification.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file’s title, description, docstrings, CLI help text, and runtime messages are written in Chinese, which effectively forces a specific language for users. The policy allows locale constraints only when users are given a choice or when the restriction is clearly documented and justified, neither of which is present here.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains natural-language strings that appear to force a specific language/locale for users, including the module description and subsequent CLI prompts/help text. Under the policy, language-specific behavior should either provide user choice or clearly document a justified regional constraint, neither of which is present here.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: Line L003 uses a language selector that defaults to English and only links to Simplified Chinese as an alternative. Under the stated policy, forcing or implicitly preferring a specific language without user opt-in can be a natural-language policy concern.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This is a markdown file, so SQP-2 applies to whether the skill description warns about behaviours that could affect user data. The README presents cleaning, conversion, filtering, and merge operations that produce modified datasets, but it does not include any caution about overwriting paths, validating transformed results, or using backups when operating on important data.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: The skill documents commands that read from and write to files and perform destructive cleaning actions such as dropping rows, removing duplicates, and outlier removal, but it does not prominently warn about irreversible data loss or require review of outputs before reuse. In this skill’s context, the examples mostly write to separate output files, which reduces severity, but users could still lose important data through aggressive cleaning choices or by adapting commands unsafely.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: This markdown file includes examples that save DataFrames to CSV, Excel, JSON, and Parquet files, which can create or overwrite local files. The surrounding documentation does not warn users that these operations write to disk or may replace existing outputs.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The data-cleaning section demonstrates dropna() and drop_duplicates(), which remove rows, columns, or records from the dataset. The document does not mention that these operations can discard data and should be reviewed before applying them in-place or to production datasets.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: The title and introductory text are entirely in Chinese, which effectively constrains the skill content to a single language without offering any user choice or noting that it is region- or language-specific. The policy explicitly calls for flagging language or locale constraints when they are imposed without opt-in.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.0.0
pyarrow>=12.0.0

• Confidence: 95% confidence
• Finding: The dependency is specified with only a lower bound, so builds may resolve to different versions over time. This weakens reproducibility and makes it hard to determine whether a deployed environment includes a vulnerable or incompatible release.

Unverifiable Dependency: pandas has 1 known advisory(ies) (CVE-2020-13091 (** DISPUTED ** pandas through 1.0.3 can unserialize and execute commands from an)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: Because pandas is not pinned, it is impossible to verify from this manifest whether deployed environments will avoid versions implicated by known advisories. The cited advisory is disputed and older, so immediate risk appears limited, but the uncertainty remains a real security-management issue.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.0.0
pyarrow>=12.0.0
xlrd>=2.0.0

• Confidence: 95% confidence
• Finding: The numpy requirement is not pinned to an exact version, allowing environment-dependent resolution. That can introduce supply-chain risk and makes security posture harder to verify consistently across installs.

Unverifiable Dependency: numpy has 16 known advisory(ies) (CVE-2014-1859 (Numpy arbitrary file write via symlink attack); CVE-2021-41495 (NumPy NULL Pointer Dereference); CVE-2021-33430 (NumPy Buffer Overflow (Disputed)) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: The manifest does not fix numpy to a specific release, so advisory applicability cannot be determined reliably. This creates uncertainty around exposure to known defects and undermines reproducible, auditable deployments.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.0.0
pyarrow>=12.0.0
xlrd>=2.0.0

• Confidence: 94% confidence
• Finding: Using an unpinned openpyxl version permits silent drift to newer releases, which may include regressions or unresolved security issues depending on install time. For a skill handling spreadsheet files, predictable dependency versions are important for both security and stability.

Unverifiable Dependency: openpyxl has 2 known advisory(ies) (CVE-2017-5992 (Improper Restriction of XML External Entity Reference in Openpyxl); CVE-2017-5992 (Openpyxl 2.4.1 resolves external entities by default, which allows remote attack)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 92% confidence
• Finding: Openpyxl has historical XML-related advisories, and the unpinned requirement prevents confirming whether the installed version is safe. Since this skill is explicitly intended to process Excel files, dependency ambiguity is more dangerous because file parsing may be exposed to attacker-controlled input.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

pandas>=2.0.0
numpy>=1.24.0
openpyxl>=3.0.0
pyarrow>=12.0.0
xlrd>=2.0.0

• Confidence: 96% confidence
• Finding: PyArrow is unpinned, so installations may pull different versions with materially different security properties. This is more concerning here because data-processing skills may parse untrusted columnar or binary data formats, increasing exposure to parser/file-handling vulnerabilities.

Unverifiable Dependency: pyarrow has 9 known advisory(ies) (CVE-2023-47248 (PyArrow: Arbitrary code execution when loading a malicious data file); CVE-2019-12408 (Missing Initialization of Resource in Apache Arrow); CVE-2019-12410 (Missing Initialization of Resource in Apache Arrow) +6 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: PyArrow has known advisories including serious file-loading issues, and the lack of version pinning means affected releases could be installed without visibility. In a pandas/data-processing skill that may load Parquet, Feather, or Arrow data from untrusted sources, this uncertainty meaningfully increases risk.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

numpy>=1.24.0
openpyxl>=3.0.0
pyarrow>=12.0.0
xlrd>=2.0.0

• Confidence: 93% confidence
• Finding: The xlrd dependency is also unpinned, which reduces build determinism and complicates verification of vulnerability exposure. While not inherently exploitable by itself, it contributes to supply-chain uncertainty.

Static analysis

No suspicious patterns detected.