T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cache_manager.py:137- Finding
Unsafe Pickle Deserialization in Persistent Embedding Cache
- Content
View full analysis
- Remediation
View remediation
Security audit
contextstable
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly does what it claims, but its local persistence and dependency setup include review-worthy security risks before installation.
Review before installing. Use an isolated virtual environment, pin and audit dependencies, avoid enabling or loading persistent embedding caches from untrusted locations, and treat saved sessions/exports as plaintext files that may contain private story drafts and prompts.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:1- Finding
Unpinned and Unused Third-Party Dependencies Expand Supply-Chain Exposure
- Content
View full analysis
=0.1.0 langchain-community>=0.0.10 sentence-transformers>=2.2.0 faiss-cpu>=1.7.4 pydantic>=2.0.0 ``` The documented installation instruction in `SKILL.md` directs users to install this dependency set: ```bash pip install -r requirements.txt ``` ### Technical Analysis Every dependency uses an open-ended minimum-version constraint. A fresh installation may therefore resolve to any later release satisfying the lower bound, including versions that were not reviewed with this Skill. No lock file or package hashes are supplied to establish reproducible, integrity-checked installations. The audit also found no imports of `langchain`, `langchain-community`, or `faiss-cpu` in the project implementation. The vector store in `scripts/vector_store.py` performs local keyword retrieval and does not use FAISS or LangChain. These unused packages introduce additional packages and transitive dependencies without supporting current functionality. `sentence-transformers` is conditionally imported by `scripts/consistency_checker.py`, although the default vector store does not initialize an embedding model. `pydantic` is directly used by `scripts/config.py`. This finding does not establish that the currently published packages are malicious. The risk results from resolving unreviewed future versions and installing unnecessary components, which increases the available supply-chain attack surface and makes builds non-reproducible. ### Attack Path 1. A user follows the documented `pip install -r requirements.txt` command. 2. The package resolver selects the latest versions satisfying the broad `>=` constraints, together with their transitive dependencies. 3. Package installation or build logic executes with the installing user's privileges. 4. If ...[truncated 968 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (25)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The skill is ներկայացված as a context-stabilization/writing aid, but the documented behavior includes persistence, embedding cache management, prompt/context caching, and loading data from disk. This mismatch is dangerous because hidden stateful storage broadens the attack surface beyond text generation, enabling unintended retention of sensitive prompts, stories, or contextual data and making users less likely to apply appropriate safeguards.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 82% confidence
- Finding
The skill documentation indicates capabilities consistent with file read/write behavior (for session save/load, export, and disk-backed cache) but does not declare any explicit tool scope or permissions. This creates a least-privilege and transparency problem: an operator may invoke the skill without understanding that it can persist or access local data, increasing the risk of unintended data exposure or overwriting files.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code presents its user-facing title entirely in Chinese, and the rest of the script continues with Chinese-only prompts and status messages. That creates a language/locale policy concern because the skill effectively forces a specific language without any user opt-in or documented justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
From the operational step labels through the advanced usage examples, the script consistently emits Chinese-only instructional text. Because no alternate locale or user choice is offered, the file contains natural-language behavior that enforces a specific language across the whole user experience.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The RuntimeError message at L073 is presented only in Chinese, which imposes a specific language for at least one user-facing interaction. The policy requires avoiding forced language/locale behavior unless the user is given a choice or the restriction is clearly justified.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The manifest describes a skill for stable-context continuation of long novel text, which implies prompt/context management for generation. This file also implements explicit story export and session persistence to disk, adding file-management behavior beyond the stated continuation function.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
Saving and loading config/history files introduces a general local persistence capability. For a skill whose stated purpose is stable continuation output, this capability is not obviously required from the manifest alone and should be explicitly justified or declared.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code persists cache contents to disk and later reloads them, which is a file write/read operation that may store user-derived text embeddings and timestamps. There is no confirmation prompt, user-facing log, or explanatory comment/docstring in this file warning that prompt-derived data may be persisted locally.
- Content
Insecure deserialization: pickle.load()
Medium
- Category
- Dangerous Code Execution
- Confidence
- 98% confidence
- Finding
The code deserializes a cache file using pickle.load() from a path derived from configuration without any integrity check or safe format restriction. If an attacker can modify or replace that file, loading it can execute arbitrary Python code during deserialization, making this a real code-execution risk rather than a harmless cache issue.
- Content
python try: with open(self.persist_path, 'rb') as f: data = pickle.load(f) with self._lock: self._cache = OrderedDict(data.get('cache', {}))
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code embeds Chinese-only anchor keys, field descriptions, and a default prompt instructing the model in Chinese, which creates a natural-language locale constraint. The file does not indicate that language selection is optional or that the skill is intentionally limited to a Chinese-specific use case.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains hard-coded Chinese user-facing messages such as '综合评分' and '发现问题', which imposes a specific language on users. The file does not provide any user opt-in, locale selection, or documented region-specific justification, matching the language/locale policy violation criteria.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
This code emits multiple natural-language strings in Chinese, such as context headers and summaries, with no apparent user opt-in or locale selection. That creates a language/locale policy issue because the skill behavior is fixed to a specific language rather than allowing the user to choose.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
Several returned and formatted user-facing strings are hard-coded in Chinese, such as context labels and summary/status messages. This creates a natural-language locale constraint without any visible opt-in, fallback, or justification that the skill is intended only for Chinese-language use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The code exports full story history, including user prompts and generated content, directly to disk in plaintext without any consent flow, visibility controls, redaction, or sensitivity checks. In this skill’s context, prompts and generated long-form content may contain private user material, making unintended local persistence and later disclosure a real privacy/security risk.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The method returns a fixed Chinese label "【相关上下文】" and the keyword extraction logic is tailored around Chinese text and Chinese stopwords. This creates a language-specific behavior without offering the user a language choice or documenting a justified locale constraint, which matches the policy-violation category for language/locale restrictions.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The dependency is specified with a lower bound only, which permits installation of any newer release, including versions with breaking changes or known vulnerable transitive trees. In a security-sensitive AI skill, unpinned packages like langchain increase supply-chain risk and make builds non-reproducible, especially given this package family has a history of security advisories.
- Content
text langchain>=0.1.0 langchain-community>=0.0.10 sentence-transformers>=2.2.0 faiss-cpu>=1.7.4
Unverifiable Dependency: langchain has 16 known advisory(ies) (CVE-2023-36258 (langchain arbitrary code execution vulnerability); CVE-2026-45134 (LangSmith SDK: Public prompt pull deserializes untrusted manifests without trust); CVE-2024-2965 (Denial of service in langchain-community) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The manifest does not pin langchain, and the package has numerous known advisories including arbitrary code execution and unsafe deserialization issues in its ecosystem. Because the installed version cannot be verified from this file, the deployment may resolve to an affected release, creating significant uncertainty and potential exposure in an LLM-integrated skill.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
Using an unpinned minimum version for langchain-community allows resolution to arbitrary later releases, making the environment non-deterministic and exposing the skill to newly introduced or previously known flaws. This is more concerning because langchain-community has multiple published advisories, so version ambiguity materially affects risk.
- Content
text langchain>=0.1.0 langchain-community>=0.0.10 sentence-transformers>=2.2.0 faiss-cpu>=1.7.4 pydantic>=2.0.0
Unverifiable Dependency: langchain-community has 13 known advisory(ies) (CVE-2024-2965 (Denial of service in langchain-community); CVE-2024-8309 (Langchain SQL Injection vulnerability); CVE-2024-5998 (LangChain pickle deserialization of untrusted data) +10 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
langchain-community is unpinned despite multiple published advisories, including SQL injection, denial of service, and unsafe pickle/deserialization issues. In a context-generation skill that likely handles external text and retrieval components, uncertainty about the installed version makes the dependency risk materially more dangerous.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The sentence-transformers requirement is not pinned, so installations may vary over time and pull in unexpected dependency updates. While the package is not flagged here with specific advisories, the lack of reproducibility still creates avoidable supply-chain and stability risk.
- Content
text langchain>=0.1.0 langchain-community>=0.0.10 sentence-transformers>=2.2.0 faiss-cpu>=1.7.4 pydantic>=2.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
An open-ended faiss-cpu version constraint can lead to inconsistent builds and unintended adoption of vulnerable or incompatible releases. Even absent a cited CVE in this finding, unpinned infrastructure packages increase operational and supply-chain exposure.
- Content
text langchain>=0.1.0 langchain-community>=0.0.10 sentence-transformers>=2.2.0 faiss-cpu>=1.7.4 pydantic>=2.0.0
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The pydantic dependency is only lower-bounded, allowing installation of versions that may contain known denial-of-service or parsing issues. Because pydantic often processes untrusted input in Python applications, unclear version selection can directly affect the skill's attack surface.
- Content
text langchain-community>=0.0.10 sentence-transformers>=2.2.0 faiss-cpu>=1.7.4 pydantic>=2.0.0
Unverifiable Dependency: pydantic has 4 known advisory(ies) (CVE-2021-29510 (Use of "infinity" as an input to datetime and date fields causes infinite loop i); CVE-2024-3772 (Pydantic regular expression denial of service); CVE-2021-29510 (Pydantic is a data validation and settings management using Python type hinting.) +1 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The unpinned pydantic dependency cannot be verified against known advisories, including denial-of-service conditions in validation and regex handling. Since validation libraries often process attacker-controlled input, version ambiguity can leave the application unexpectedly exposed.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The save_session method creates directories and writes configuration/history data to disk, which is a safety-relevant file-write operation. In this file there is no confirmation prompt, logging/print statement, or explanatory comment/docstring warning the user that session data will be persisted.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The prompt prefix is hardcoded as Chinese text ("【核心设定】") with no indication that the user can choose a language or locale. For organizations requiring language neutrality or user-selected locale, this natural-language constraint can be a policy violation.
- Content
Static analysis
No suspicious patterns detected.