Qubitclient

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:59 AM UTC
• Version: 0.1.0

Overview

The skill appears purpose-aligned for quantum calibration work, but it asks users to install and configure software that can control live measurements while giving too little guidance on safety limits and secret handling.

Review carefully before installing. Use an isolated virtual environment, pin and verify package versions, keep qubitclient.json out of source control with owner-only permissions, prefer secret managers or environment variables, use HTTPS or strictly local loopback endpoints, and require human approval plus lab-specific safety limits before any live measurement control or parameter update.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17-20
Vulnerability Type: Unpinned and unverifiable third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

# Basic installation
pip install 'qubitclient'

# Full installation (all features)
pip install 'qubitclient[full]'

Technical Analysis

The installation instructions retrieve and install the latest available version of qubitclient, or the package together with every dependency selected by its full extra. No audited version, lockfile, package hash, trusted source URL, or integrity-verification procedure is specified.

Consequently, the effective code installed by these commands can change after this Skill has been reviewed. Package installation may execute package-controlled build logic, while subsequent use imports and executes the installed package and its dependencies. This creates supply-chain exposure if the package account, distribution channel, release artifact, or a transitive dependency is compromised.

The audited project contains only SKILL.md; it does not include source code or dependency metadata with which to verify the behavior of the package fetched by these commands.

Attack Path

1. An attacker compromises the qubitclient distribution account, a selected dependency, or an associated release process.
2. The attacker publishes a malicious package version or replaces an artifact available from the configured Python package index.
3. A user follows the Skill instructions and runs one of the unpinned pip install commands.
4. pip resolves and downloads the attacker-controlled release without checking against a project-supplied expected version and hash.
5. Malicious package code executes during installation where applicable, or when the user imports and invokes qubitclient.

Impact Assessment

Successful exploitation can execute arbitrary code with the privileges of the accou ...[truncated 392 chars]

Remediation

View remediation

Remediation Suggestions

• Pin qubitclient to a specific version that has undergone security review.
• Publish a lockfile containing exact versions for all direct and transitive dependencies, including the full extra.
• Record and verify cryptographic hashes using a hash-locked requirements file and pip install --require-hashes.
• Identify the official package repository and trusted distribution source in the documentation.
• Review the resolved dependency tree and repeat the audit before updating any pinned version.
• Install the package in an isolated virtual environment under a non-privileged account.
• Prefer prebuilt, signed, and provenance-attested artifacts where available.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31

Finding

Plaintext Credential Storage and Insecure Example Transport

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31-49
Vulnerability Type: Plaintext sensitive configuration and unencrypted service endpoints
Risk Level: Medium

Vulnerable Code

json

{
  "url": "http://0.0.0.0:9801",
  "api_key": "your-proxy-api-key",
  "llm": {
    "api_key": "your-vllm-api-key",
    "base_url": "http://xx.xx.xx.xx:9091/v1",
    "model": "nv-community/Ising-Calibration-1-35B-A3B"
  },
  "generate": {
    "api_key": "your-vllm-api-key",
    "base_url": "http://xx.xx.xx.xx:9091/v1",
    "model": "Qwen/Qwen-Image-Edit"
  },
  "license": {
    "token": "your-license-token"
  }
}

Technical Analysis

The Skill states that qubitclient init generates qubitclient.json in the current project directory and instructs users to place server API keys, VLLM API keys, and a license token directly in that JSON file. The documentation does not require restrictive file permissions, exclusion from source control, encryption at rest, or integration with a secret manager.

Because the file is created in a project directory, it can be accidentally committed to a repository, included in build artifacts or backups, copied into shared workspaces, or read by other local users if its permissions are too broad.

The same example uses plaintext http:// endpoints for authenticated services. If those examples are adapted for communication across an untrusted or shared network, credentials, requests, calibration data, and service responses may be exposed to passive interception or active modification.

Attack Path

Local or repository disclosure path:

1. A user runs qubitclient init in a project directory.
2. The user replaces the placeholders with operational API keys and a license token.
3. The generated JSON file is committed, archived, uploaded, backed up, or left readable by another local account.
4. An attacker obtains the file and extracts the plainte ...[truncated 1331 chars]

Remediation

View remediation

Remediation Suggestions

• Store secrets in environment variables, an operating-system credential store, or a dedicated cloud secret manager rather than in project configuration files.
• Keep only non-sensitive settings in qubitclient.json; support references to externally managed secret identifiers.
• If a local secret file is unavoidable, create it with owner-only permissions such as mode 0600.
• Automatically add secret-bearing configuration files to .gitignore and provide a separate placeholder-only example file.
• Add secret scanning to pre-commit hooks and continuous-integration pipelines.
• Use short-lived, narrowly scoped credentials and document revocation and rotation procedures.
• Replace HTTP examples with HTTPS endpoints and require certificate and hostname validation.
• Reject or prominently warn about plaintext remote endpoints; if local HTTP is supported, restrict it explicitly to loopback-only use.
• Rotate any operational credentials that may already have been committed, shared, or transmitted without encryption.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill advertises real-time measurement control and parameter updates during live operation without documenting any safety boundaries, confirmation requirements, or operational safeguards. In a lab-control context, this can enable unsafe or unintended changes to running experiments or attached instrumentation, especially if an agent uses the capability autonomously based only on the skill description.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.