T08 · Insecure Dependencies
Warning
- Location
SKILL.md:55- Finding
Unpinned and Unauditable Third-Party Package Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
private computation
Security checks for vulnerabilities and agentic risk
Overview
This skill is about private computation, but it advertises strong privacy and compliance protections that its own documentation says are not implemented yet.
Review this carefully before installing. Do not rely on it for zero-knowledge execution, TEE isolation, HIPAA/GDPR compliance, medical, financial, or other regulated workloads unless the publisher provides the actual reviewed implementation, version pinning, key-management details, audit-log safeguards, and evidence that the advertised security modes are implemented and fail closed when unavailable.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Error
- Location
SKILL.md:24- Finding
Security and Compliance Claims Contradict Documented Implementation Status
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill markets itself as providing current 'zero-knowledge execution' and privacy/security assurances, but the body of the document later states that zero-knowledge proofs and TEE isolation are future or planned features. This can cause users to rely on non-existent protections for highly sensitive workloads such as medical, financial, or private-context processing, creating a dangerous mismatch between perceived and actual security guarantees.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation states that 'strict' mode provides zero-knowledge proofs, while other sections say that zero-knowledge functionality is only planned. Users may select 'strict' mode believing it adds strong cryptographic privacy guarantees when it may not do anything beyond the MVP feature set, leading to unsafe deployment decisions in regulated or high-sensitivity environments.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The API reference advertises a 'proof' execution option for generating zero-knowledge proofs, but the roadmap says proof generation is a future feature. This is dangerous because integrators may build compliance or privacy workflows around proof artifacts that are never actually produced or verified, resulting in silent security failure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill strongly encourages audit logging for sensitive tasks but does not warn that task metadata, identifiers, or operational details may themselves contain sensitive information. In a privacy-focused skill, this omission is more dangerous because users may assume all logging is inherently safe and accidentally create durable records of regulated or confidential data.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The examples show storing API keys and other secrets locally through a simple API without warning users about where secrets are stored, how the master key is managed, and what local compromise would expose. In this context, the risk is amplified because the skill is explicitly marketed for sensitive and regulated workloads, so users may overtrust local secret handling without understanding their operational responsibilities.
- Content