model-card-generator

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:34 PM UTC
• Version: 1.0.0

Overview

This is a simple model-card generator with disclosed file-output behavior and no evidence of hidden data access, persistence, or malicious instructions.

Before installing, verify the repository and pin to a specific reviewed commit or release because the published install commands fetch mutable remote content. Use the generator in a normal project/output folder, avoid sensitive paths for --out, and review generated model cards before relying on them for governance or compliance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:77
• Finding: Unpinned Remote Installation Sources Create Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 77-81 **Vulnerability Type**: Unpinned third-party package and mutable repository installation **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash # One-click installation using the skills CLI npx skills add zhaoxinghua09-cell/agent-skills -g # Alternatively, clone and copy this skill into the Agent skill directory git clone https://github.com/zhaoxinghua09-cell/agent-skills.git cp -r agent-skills/skills/model-card-generator ~/.workbuddy/skills/ ``` ### Technical Analysis The documented installation process retrieves components from remote, mutable sources without pinning them to reviewed versions or cryptographic identities. The `npx skills` invocation does not specify an exact package version or integrity hash. The Git command clones the repository's current default branch rather than a reviewed commit hash or signed release tag. As a result, the material installed by these commands may differ from the artifact covered by this audit. The copied destination is an Agent skill directory. Content placed there can include instructions and executable scripts that the Agent may subsequently load or invoke. This finding does not establish that the currently audited files are malicious; it identifies a supply-chain path through which future or compromised upstream content could be substituted after review. ### Attack Path 1. An attacker compromises the relevant package publisher, source repository, maintainer account, or upstream distribution channel. 2. The attacker modifies the remote Skill instructions or scripts. 3. A user follows the installation instructions in `SKILL.md`. 4. `npx` obtains an unpinned package, or Git clones the mutable default branch. 5. The retrieved Skill is installed globally or copied into the Agent's Skill directory. 6. The Agent later loads the substituted instructions or executes the substituted scripts under the user' ...[truncated 643 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI package to an exact reviewed version rather than relying on the version selected by `npx`. 2. Pin the Git installation to a specific reviewed commit hash or a cryptographically signed release. 3. Publish and verify SHA-256 checksums or signed provenance attestations for distributed Skill artifacts. 4. Verify the repository identity and fetched commit before copying files into an Agent skill directory. 5. Avoid global installation unless it is operationally necessary; prefer an isolated, least-privileged environment. 6. Document a reproducible installation procedure that guarantees the installed files match the reviewed artifact. 7. Re-audit any fetched version whose digest differs from the approved release digest.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/model_card_generator.py:47
• Finding: Caller-Controlled Output Path Can Overwrite Arbitrary User-Writable Files## Vulnerability Details **File Location**: `scripts/model_card_generator.py`, lines 47-50 **Vulnerability Type**: Unrestricted file write and overwrite **Risk Level**: Low **Vulnerable Code Snippet**: ```python if a.out: outp = pathlib.Path(a.out) outp.parent.mkdir(parents=True, exist_ok=True) outp.write_text(text, encoding="utf-8") ``` ### Technical Analysis The `--out` argument controls the complete destination path. The script creates missing parent directories and writes with `Path.write_text()`, which truncates an existing target before writing the generated Markdown. It does not enforce an approved output root, reject path traversal, check whether the destination is a symbolic link, use exclusive file creation, or request confirmation before replacing an existing file. This is primarily dangerous when an Agent constructs command-line arguments from untrusted requests. An attacker could supply an absolute path or a relative path containing parent-directory components. If the target is writable by the process, the script will replace it with model-card text. The generated content is structured Markdown rather than arbitrary binary data, which limits direct code-execution opportunities. Nevertheless, overwriting configuration, documentation, or other writable files can cause data loss or application disruption. Symlinked destinations may also redirect the write to another file accessible to the process. ### Attack Path 1. An attacker provides an output path through a prompt, workflow input, or other untrusted source. 2. An Agent passes that value directly to the script as `--out`. 3. The supplied path identifies an existing user-writable file, a new path outside the intended output directory, or a symbolic link to another writable file. 4. The script creates missing parent directories where permitted. 5. `write_text()` truncates and replaces the selected target with generated Markdown. ### Impact ...[truncated 510 chars]
• Remediation: ## Remediation Suggestions 1. Require output files to reside beneath a dedicated, explicitly configured output directory. 2. Resolve the requested path and verify that it remains inside the approved directory before writing. 3. Reject symbolic links in the destination and relevant parent path components. 4. Use exclusive creation by default so an existing file is not silently replaced. 5. Add an explicit `--force` option for intentional overwrites and clearly warn the caller before replacement. 6. Reject absolute paths and parent-directory traversal when arbitrary destinations are unnecessary. 7. When used by an Agent, validate `--out` independently rather than passing prompt-derived paths directly to the script. 8. Run the generator with least privilege and without write access to sensitive configuration or executable locations.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises operational behavior that can lead to file creation or modification via its referenced scripts and generated Markdown/JSON outputs, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch weakens user and agent control boundaries, making unintended file writes or overly broad execution more likely when an agent interprets the skill.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file presents the skill name, description, and operational guidance entirely in Chinese, including the main README content and usage instructions. This can violate a language/locale policy when users are not given an explicit choice of language or informed that the skill is Chinese-only.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: The installation instruction uses `npx skills` without pinning a specific version, so execution may pull and run whatever package version is current at install time. This creates a supply-chain risk: a compromised, replaced, or breaking upstream package could execute unexpected code on the user's machine.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The example command hard-codes a limitation of "只支持中文" (Chinese only). This is a natural-language locale restriction presented without any user opt-in, alternative language choice, or clear region-specific justification, which matches the language/locale policy violation category.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The title and body present the attestation primarily in Chinese, with only a bilingual title, and there is no indication that users can choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The file includes Chinese-only or primarily Chinese phrases in core descriptive lines ('LGD-I 有籍', '凡自治之物') while the rest of the README is in English. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation when no language choice or justification is provided.

Static analysis

No suspicious patterns detected.